CVE-2022-2431

{"id": "CVE-2022-2431", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2022-09-06T18:15:13.470", "references": [{"url": "https://packetstormsecurity.com/files/167920/wpdownloadmanager3250-filedelete.txt", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail=", "tags": ["Patch", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-in-download-manager-plugin/", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}, {"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server."}, {"lang": "es", "value": "El plugin Download Manager para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos en versiones hasta 3.2.50 incluy\u00e9ndola. Esto es debido a la insuficiente comprobaci\u00f3n del tipo de archivo y de la ruta en la funci\u00f3n deleteFiles() que es encontrado en el archivo ~/Admin/Menu/Packages.php y que es desencadenado cuando es eliminado una entrada de descarga. Esto hace posible que los usuarios de nivel de colaborador y superior suministren una ruta de archivo arbitraria por medio del par\u00e1metro \"file[files]\" cuando es creado una entrada de descarga y, una vez que el usuario elimina la entrada, el archivo arbitrario suministrado ser\u00e1 eliminado. Esto puede ser usado por atacantes para eliminar el archivo /wp-config.php que restablecer\u00e1 la instalaci\u00f3n y har\u00e1 posible que un atacante logre una ejecuci\u00f3n de c\u00f3digo remota en el servidor."}], "lastModified": "2022-09-09T03:12:17.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpdownloadmanager:wordpress_download_manager:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "DB4755F0-A60C-46CC-B297-71B313A9C07E", "versionEndIncluding": "3.2.50"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}