7.5

CVE-2014-9735

Exploit

Slider Revolution < 3.0.96 & Showbiz Pro < 1.7.1 - Missing Authorization to Arbitrary File Upload

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Mögliche Gegenmaßnahme
Slider Revolution: Update to version 3.0.96, or a newer patched version
Showbiz Pro Responsive Teaser WordPress Plugin: Update to version 1.7.1, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Slider Revolution
Version [*, 3.0.96)
SystemWordPress Plugin
≫
Produkt Showbiz Pro Responsive Teaser WordPress Plugin
Version [*, 1.7.1)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Themepunch ≫ Showbiz Pro SwPlatformwordpress Version <= 1.7.1
Themepunch ≫ Slider Revolution SwPlatformwordpress Version <= 3.0.95
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 82.75% 0.992
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.