CVE-2020-36728

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

CVSS 6.5 MEDIUMEPSS 3.2%CWE-22

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 6.5EPSS 3.2%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

07 jun 2023Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Productos afectados

tunafish · Adning Advertising

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693 https://www.wordfence.com/blog/2020/07/critical-vulnerabilities-patched-in-adning-advertising-plugin/https://www.wordfence.com/threat-intel/vulnerabilities/id/e7506429-7f8a-45b5-b1b0-6fdb39599ee5?source=cve