7.5

CVE-2019-1000031

article2pdf <= 0.27 - Denial of Service

A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.
Mögliche Gegenmaßnahme
article2pdf: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Article2pdf Project ≫ Article2pdf SwPlatformwordpress Version >= 0.24 <= 0.27
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt article2pdf
Version 0.24
Version 0.25
Version 0.26
Version 0.27
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.73% 0.884
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html
Third Party Advisory
VDB Entry
https://seclists.org/bugtraq/2019/Mar/49
Third Party Advisory
Mailing List
https://wpvulndb.com/vulnerabilities/9246
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/09fc8d80-8231-4183-9626-c90f4fee5eb4
Third Party Advisory