exploitDog

CVE-2024-5153

Опубликовано: 06 июн. 2024

Источник: nvd

CVSS3: 9.1

CVSS3: 9.8

EPSS Низкий

Описание

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:web-shop-host:startklar_elmentor_addons:*:*:*:*:*:wordpress:*:*

Версия до 1.7.15 (включая)

EPSS

Процентиль: 90%

0.05452

Низкий

9.1 Critical

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-xqr2-65hp-h5j3

CVSS3: 9.1

github

больше 1 года назад

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.

EPSS

Процентиль: 90%

0.05452

Низкий

9.1 Critical

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-22