518 lines
22 KiB
JSON
518 lines
22 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-32111",
|
||
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Patchstack",
|
||
"dateReserved": "2024-04-10T19:19:25.420Z",
|
||
"datePublished": "2024-06-25T13:35:45.596Z",
|
||
"dateUpdated": "2026-04-28T16:09:34.172Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WordPress",
|
||
"vendor": "Automattic",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.5.5",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.5.4",
|
||
"status": "affected",
|
||
"version": "6.5",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.4.5",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.4.4",
|
||
"status": "affected",
|
||
"version": "6.4",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.3.5",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.3.4",
|
||
"status": "affected",
|
||
"version": "6.3",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.2.6",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.2.5",
|
||
"status": "affected",
|
||
"version": "6.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.1.7",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.1.6",
|
||
"status": "affected",
|
||
"version": "6.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "6.0.9",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "6.0.8",
|
||
"status": "affected",
|
||
"version": "6.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.9.10",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.9.9",
|
||
"status": "affected",
|
||
"version": "5.9",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.8.10",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.8.9",
|
||
"status": "affected",
|
||
"version": "5.8",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.7.12",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.7.11",
|
||
"status": "affected",
|
||
"version": "5.7",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.6.14",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.6.13",
|
||
"status": "affected",
|
||
"version": "5.6",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.5.15",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.5.14",
|
||
"status": "affected",
|
||
"version": "5.5",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.4.16",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.4.15",
|
||
"status": "affected",
|
||
"version": "5.4",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.3.18",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.3.17",
|
||
"status": "affected",
|
||
"version": "5.3",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.2.21",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.2.20",
|
||
"status": "affected",
|
||
"version": "5.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.1.19",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.1.18",
|
||
"status": "affected",
|
||
"version": "5.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "5.0.22",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "5.0.21",
|
||
"status": "affected",
|
||
"version": "5.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.9.26",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.9.25",
|
||
"status": "affected",
|
||
"version": "4.9",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.8.25",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.8.24",
|
||
"status": "affected",
|
||
"version": "4.8",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.7.29",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.7.28",
|
||
"status": "affected",
|
||
"version": "4.7",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.6.29",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.6.28",
|
||
"status": "affected",
|
||
"version": "4.6",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.5.32",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.5.31",
|
||
"status": "affected",
|
||
"version": "4.5",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.4.33",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.4.32",
|
||
"status": "affected",
|
||
"version": "4.4",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.3.34",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.3.33",
|
||
"status": "affected",
|
||
"version": "4.3",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.2.38",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.2.37",
|
||
"status": "affected",
|
||
"version": "4.2",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "4.1.41",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThanOrEqual": "4.1.40",
|
||
"status": "affected",
|
||
"version": "4.1",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"user": "00000000-0000-4000-9000-000000000000",
|
||
"value": "Rafie Muhammad (Patchstack)"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Edouard L. (Patchstack)"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "David Fifield"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "x89"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "apple502j"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "mishre"
|
||
}
|
||
],
|
||
"datePublic": "2024-06-25T13:30:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.<p>This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.</p>"
|
||
}
|
||
],
|
||
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-139",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-139 Relative Path Traversal"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "HIGH",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "LOW",
|
||
"baseScore": 5,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "LOW",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-22",
|
||
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||
"shortName": "Patchstack",
|
||
"dateUpdated": "2026-04-28T16:09:34.172Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vdb-entry"
|
||
],
|
||
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
|
||
},
|
||
{
|
||
"tags": [
|
||
"release-notes"
|
||
],
|
||
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
|
||
}
|
||
],
|
||
"value": "Update to safe (6.5.5, 6.4.5, 6.3.5, 6.2.6, 6.1.7, 6.0.9, 5.9.10, 5.8.10, 5.7.12, 5.6.14, 5.5.15, 5.4.16, 5.3.18, 5.2.21, 5.1.19, 5.0.22, 4.9.26, 4.8.25, 4.7.29, 4.6.29, 4.5.32, 4.4.33, 4.3.34, 4.2.38, 4.1.41) or higher version."
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-27T13:40:36.313046Z",
|
||
"id": "CVE-2024-32111",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-27T19:20:35.758Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T02:06:44.011Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vdb-entry",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve"
|
||
},
|
||
{
|
||
"tags": [
|
||
"release-notes",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |