CVE-2024-8352

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78	Product
https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2Ftrunk	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hypestudio:social_web_suite:*:*:*:*:*:wordpress:*:*

History

08 Oct 2024, 14:17

Type	Values Removed	Values Added
References	~~() https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78 -~~	() https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78 - Product
References	~~() https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2Ftrunk -~~	() https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2Ftrunk - Patch
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cve - Third Party Advisory
First Time		Hypestudio Hypestudio social Web Suite
CPE		cpe:2.3:a:hypestudio:social_web_suite::::::wordpress::*

04 Oct 2024, 13:50

Type	Values Removed	Values Added
Summary		(es) El complemento Social Web Suite – Social Media Auto Post, Social Media Auto Publish para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 4.1.11 incluida a través de la función download_log. Esto permite que atacantes no autenticados lean el contenido de archivos arbitrarios en el servidor, que pueden contener información confidencial.

03 Oct 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-03 04:15

Updated : 2024-10-08 14:17

NVD link : CVE-2024-8352

Mitre link : CVE-2024-8352

CVE.ORG link : CVE-2024-8352

JSON object : View

Products Affected

hypestudio

social_web_suite

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

7.5 /10