4.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
5.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.9%
The WordPress plugin
# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
CPE = "cpe:/a:shortpixel:enable_media_replace";
if (description)
{
script_oid("1.3.6.1.4.1.25623.1.0.127505");
script_version("2023-10-13T16:09:03+0000");
script_tag(name:"last_modification", value:"2023-10-13 16:09:03 +0000 (Fri, 13 Oct 2023)");
script_tag(name:"creation_date", value:"2023-08-01 08:30:03 +0000 (Tue, 01 Aug 2023)");
script_tag(name:"cvss_base", value:"6.1");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:M/C:N/I:C/A:N");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2022-10-11 18:01:00 +0000 (Tue, 11 Oct 2022)");
script_cve_id("CVE-2022-2554");
script_tag(name:"qod_type", value:"remote_banner");
script_tag(name:"solution_type", value:"VendorFix");
script_name("WordPress Enable Media Replace Plugin < 4.0.0 Path Traversal Vulnerability");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2023 Greenbone AG");
script_family("Web application abuses");
script_dependencies("gb_wordpress_plugin_http_detect.nasl");
script_mandatory_keys("wordpress/plugin/enable-media-replace/detected");
script_tag(name:"summary", value:"The WordPress plugin 'Enable Media Replace' is prone to a
path traversal vulnerability.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"The plugin does not ensure that renamed files are moved to the
Upload folder, which could allow high privilege users such as admin to move them outside to the
web root directory via a path traversal attack.");
script_tag(name:"affected", value:"WordPress Enable Media Replace plugin prior to version
4.0.0.");
script_tag(name:"solution", value:"Update to version 4.0.0 or later.");
script_xref(name:"URL", value:"https://wpscan.com/vulnerability/5872f4bf-f423-4ace-b8b6-d4cc4f6ca8d9");
exit(0);
}
include( "host_details.inc" );
include( "version_func.inc" );
if( ! port = get_app_port( cpe: CPE ) )
exit( 0 );
if( ! infos = get_app_version_and_location( cpe: CPE, port: port, exit_no_version: TRUE ) )
exit( 0 );
version = infos["version"];
location = infos["location"];
if( version_is_less( version: version, test_version: "4.0.0" ) ) {
report = report_fixed_ver( installed_version: version, fixed_version: "4.0.0", install_path: location );
security_message( port: port, data: report );
exit( 0 );
}
exit( 99 );
4.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
5.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.9%