CVE-2020-35945

Опубликовано: 01 янв. 2021

Источник: nvd

CVSS3: 9.9

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.

Ссылки

https://wpscan.com/vulnerability/10342
Broken Link
Exploit
Third Party Advisory
https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-sites-using-divi-extra-and-divi-builder/
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/10342
Broken Link
Exploit
Third Party Advisory
https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-sites-using-divi-extra-and-divi-builder/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:elegantthemes:divi:*:*:*:*:*:wordpress:*:*

Версия от 3.0 (включая) до 4.5.3 (исключая)

cpe:2.3:a:elegantthemes:divi_builder:*:*:*:*:*:wordpress:*:*

Версия от 2.0 (включая) до 4.5.3 (исключая)

cpe:2.3:a:elegantthemes:extra:*:*:*:*:*:wordpress:*:*

Версия от 2.0 (включая) до 4.5.3 (исключая)

EPSS

Процентиль: 84%

0.02232

Низкий

9.9 Critical

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-v452-696f-f255

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 84%

0.02232

Низкий

9.9 Critical

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434