The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Oct/0 | Exploit Mailing List Third Party Advisory |
| https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5 | Exploit Patch Third Party Advisory |
| http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Oct/0 | Exploit Mailing List Third Party Advisory |
| https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 07:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2022/Oct/0 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5 - Exploit, Patch, Third Party Advisory |
Information
Published : 2022-09-16 09:15
Updated : 2024-11-21 07:01
NVD link : CVE-2022-2863
Mitre link : CVE-2022-2863
CVE.ORG link : CVE-2022-2863
JSON object : View
Products Affected
wpvivid
- migration\,_backup\,_staging
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')