CVE-2023-3813

Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download

CVSS 7.5 HIGHEPSS 1.0%CWE-22

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.5EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

21 jul 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Productos afectados

artbees · Jupiter X Core

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.6.9/includes/extensions/raven/includes/utils.php#L451 https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425 https://plugins.trac.wordpress.org/changeset/3138013/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php https://plugins.trac.wordpress.org/changeset/3142669/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cve