4.9

CVE-2022-0493

Exploit

String Locator < 2.5.0 - Admin+ Arbitrary File Read

String Locator <= 2.4.2 - Authenticated Arbitrary File Read

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
Mögliche Gegenmaßnahme
String locator: Update to version 2.5.0, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
String Locator Project ≫ String Locator SwPlatformwordpress Version < 2.5.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt String locator
Version [*, 2.5.0)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.36% 0.681
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://plugins.trac.wordpress.org/changeset/2685592
Vendor Advisory
Release Notes
https://wpscan.com/vulnerability/21e2e5fc-03d2-4791-beef-07af6bf985ed
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3859eb-5a1f-408c-84aa-acfc68bd0bb5
Third Party Advisory