7.5

CVE-2014-6446

Exploit

Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Mögliche Gegenmaßnahme
Infusionsoft Gravity Forms Add-on: Update to version 1.5.11, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Infusionsoft Gravity Forms Add-on
Version 1.5.3-1.5.10
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.3 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.4 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.4.1 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.4.2 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.5 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.6 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.7 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.7.1 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.7.2 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.8 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.8.1 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9.1 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9.2 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9.3 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9.4 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.9.5 SwPlatformwordpress
Infusionsoft Gravity Forms Project ≫ Infusionsoft Gravity Forms Version1.5.10 SwPlatformwordpress
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 80.81% 0.99
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.