CVE-2023-3813

Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download

CVSS 7.5 HIGHEPSS 1.0%CWE-22

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

21 jul 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

artbees · Jupiter X Core

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.6.9/includes/extensions/raven/includes/utils.php#L451 https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425 https://plugins.trac.wordpress.org/changeset/3138013/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php https://plugins.trac.wordpress.org/changeset/3142669/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cve