CVE-2023-0156

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0156
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:updraftplus:all-in-one_security:*:*:*:*:*:wordpress:*:*
History

07 Nov 2023, 03:59

Type Values Removed Values Added
CWE CWE-22

14 Apr 2023, 03:54

Type Values Removed Values Added
References (MISC) https://wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759 - (MISC) https://wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759 - Exploit, Third Party Advisory
First Time Updraftplus
Updraftplus all-in-one Security
CPE cpe:2.3:a:updraftplus:all-in-one_security:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9

10 Apr 2023, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-10 14:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-0156

Mitre link : CVE-2023-0156

CVE.ORG link : CVE-2023-0156

JSON object : View

Products Affected

updraftplus

  • all-in-one_security
CWE

No CWE.