CVE-2019-14467

Опубликовано: 18 нояб. 2019

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.

Ссылки

http://packetstormsecurity.com/files/155357/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2019/Nov/13
Exploit
Mailing List
Third Party Advisory
https://wordpress.org/plugins/social-photo-gallery/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9952
Third Party Advisory
http://packetstormsecurity.com/files/155357/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2019/Nov/13
Exploit
Mailing List
Third Party Advisory
https://wordpress.org/plugins/social-photo-gallery/#developers
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9952
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:infoway:social_photo_gallery:1.0:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 92%

0.08613

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-77pv-pggh-8r9c

github

больше 3 лет назад