CVE-2023-2117

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2117
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3 Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:*
History

07 Nov 2023, 04:12

Type Values Removed Values Added
CWE CWE-22

05 Jun 2023, 14:52

Type Values Removed Values Added
First Time 10web
10web image Optimizer
CPE cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:*
References (MISC) https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3 - (MISC) https://wpscan.com/vulnerability/44024299-ba40-4da7-81e1-bd44d10846f3 - Exploit
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 2.7

30 May 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-30 08:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-2117

Mitre link : CVE-2023-2117

CVE.ORG link : CVE-2023-2117

JSON object : View

Products Affected

10web

  • image_optimizer
CWE

No CWE.