CVE-2024-13671

Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read

CVSS 7.5 HIGHEPSS 0.5%CWE-22

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jan 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-25155 is likely a duplicate of this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

efreja · Music Sheet Viewer

Referências

https://plugins.trac.wordpress.org/browser/music-sheet-viewer/trunk/music-sheet-viewer.php#L748 https://www.wordfence.com/threat-intel/vulnerabilities/id/569f1cd4-195b-41d4-85cb-f529a1eb18d4?source=cve