Описание
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.5.4 (исключая)
cpe:2.3:a:ffw:omgf:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 88%
0.0399
Низкий
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-22
Связанные уязвимости
github
больше 3 лет назад
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
EPSS
Процентиль: 88%
0.0399
Низкий
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-22