CVE-2014-8799

Опубликовано: 28 нояб. 2014

Источник: nvd

CVSS2: 5

EPSS Высокий

Описание

Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.

Ссылки

http://security.szurek.pl/dukapress-252-path-traversal.html
Exploit
http://www.exploit-db.com/exploits/35346
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/98943
https://plugins.trac.wordpress.org/changeset/1024640/dukapress
Vendor Advisory
https://wordpress.org/plugins/dukapress/changelog/
Vendor Advisory
http://security.szurek.pl/dukapress-252-path-traversal.html
Exploit
http://www.exploit-db.com/exploits/35346
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/98943
https://plugins.trac.wordpress.org/changeset/1024640/dukapress
Vendor Advisory
https://wordpress.org/plugins/dukapress/changelog/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dukapress:dukapress:*:*:*:*:*:wordpress:*:*

Версия до 2.5.3 (включая)

EPSS

Процентиль: 99%

0.88094

Высокий

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-cw29-qgm5-wvqc

github

больше 3 лет назад