Design/Logic Flaw

2017-07-2615:29:00

PRIOn knowledge base

www.prio-n.com

0.002 Low

EPSS

Percentile

52.0%

JSON

In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (…) – however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00…/.%00…/ attack.

CPENameOperatorVersion
wp-rocketeq2.6.14
wp-rocketeq2.0.4
wp-rocketeq2.5.9
wp-rocketeq2.0.0
wp-rocketeq2.9.1
wp-rocketeq2.7.3
wp-rocketeq2.7.0
wp-rocketeq2.8.5
wp-rocketeq2.10.0
wp-rocketeq2.3.9

Name	Operator	Version
wp-rocket	eq	2.6.14
wp-rocket	eq	2.0.4
wp-rocket	eq	2.5.9
wp-rocket	eq	2.0.0
wp-rocket	eq	2.9.1
wp-rocket	eq	2.7.3
wp-rocket	eq	2.7.0
wp-rocket	eq	2.8.5
wp-rocket	eq	2.10.0
wp-rocket	eq	2.3.9