Описание
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.6.0 (исключая)
cpe:2.3:a:cozmoslabs:user_profile_picture:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 39%
0.00175
Низкий
5.4 Medium
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-639
CWE-639
Связанные уязвимости
github
больше 3 лет назад
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
EPSS
Процентиль: 39%
0.00175
Низкий
5.4 Medium
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-639
CWE-639