Описание
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.4.7 (исключая)
cpe:2.3:a:awesomemotive:duplicator:*:*:*:*:lite:wordpress:*:*
EPSS
Процентиль: 98%
0.52012
Средний
7.5 High
CVSS3
Дефекты
CWE-425
Связанные уязвимости
CVSS3: 7.5
github
больше 3 лет назад
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
EPSS
Процентиль: 98%
0.52012
Средний
7.5 High
CVSS3
Дефекты
CWE-425