CVE-2020-35945

Exploit

EPSS 2.23%
Veröffentlicht 01.01.2021 04:15:13
Zuletzt bearbeitet 04.02.2026 18:54:43
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Elegant Themes (Multiple Versions) - Arbitrary File Upload

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.

Mögliche Gegenmaßnahme

Divi Builder: Update to version 4.5.3, or a newer patched version

Divi: Update to version 4.5.3, or a newer patched version

Divi Extra: Update to version 4.5.3, or a newer patched version

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 6

Weitere Schwachstelleninformationen

SystemWordPress Plugin

≫

Produkt Divi Builder

Version *-4.3.2

SystemWordPress Theme

≫

Produkt Divi

Version *-4.3.2

SystemWordPress Theme

≫

Produkt Divi Extra

Version *-4.3.2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Elegantthemes ≫ Divi SwPlatformwordpress Version >= 3.0 < 4.5.3

Elegantthemes ≫ Divi Builder SwPlatformwordpress Version >= 2.0 < 4.5.3

Elegantthemes ≫ Extra SwPlatformwordpress Version >= 2.0 < 4.5.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.23%	0.843

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P
cve@mitre.org	9.9	3.1	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H