CVE-2023-7061

EPSS 12.27%
Published 10.07.2024 02:15:02
Last modified 21.11.2024 08:45:09
Source security@wordfence.com
Teams watchlist Login
Open Login

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Advancedfilemanager ≫ File Manager Advanced Shortcode SwPlatformwordpress Version <= 2.5.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	12.27%	0.936

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
security@wordfence.com	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://advancedfilemanager.com/product/file-manager-advanced-shortcode-wordpress/

Product

https://www.wordfence.com/threat-intel/vulnerabilities/id/26050f70-7a10-4df5-acd5-1c9e7613bf2c?source=cve

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-7061

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-7061

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-7061

EUVD