PatchstackVULNRICHMENT:CVE-2024-27954CVE-2024-27954 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
21.4%
SSVC
Exploitation
poc
Automatable
yes
Technical Impact
partial
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Automatic",
"vendor": "WP Automatic",
"versions": [
{
"changes": [
{
"at": "3.92.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.92.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
]ADP Affected
[
{
"cpes": [
"cpe:2.3:a:wp_automatic:automatic:*:*:*:*:*:*:*:*"
],
"vendor": "wp_automatic",
"product": "automatic",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "3.92.0"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
21.4%
SSVC
Exploitation
poc
Automatable
yes
Technical Impact
partial