Описание
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.45.22 (включая)
cpe:2.3:a:sermon_browser_project:sermon_browser:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 32%
0.0012
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 8.8
github
почти 4 года назад
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
EPSS
Процентиль: 32%
0.0012
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-352