9.8

CVE-2018-25095

Exploit

Duplicator < 1.3.0 - Unauthenticated RCE

Duplicator < 1.3.0 - Unauthenticated Remote Code Execution

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Mögliche Gegenmaßnahme
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More: Update to version 1.3.0, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Awesomemotive ≫ Duplicator SwEditionlite SwPlatformwordpress Version < 1.3.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
Version [*, 1.3.0)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.92% 0.555
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/16cc47aa-cb31-4114-b014-7ac5fbc1d3ee
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/c5757abd-33dc-4751-bc55-afd944ff2341
Third Party Advisory