2 lines
3.9 KiB
JSON
2 lines
3.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Migration, Backup, Staging – WPvivid","vendor":"wpvividplugins","versions":[{"status":"affected","version":"0.9.89"}]}],"source":"security@wordfence.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wpvivid:migration\\,_backup\\,_staging:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"7DACB4DD-9204-4B8D-8C43-F0967E26EDC4","versionEndExcluding":"0.9.90","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments."},{"lang":"es","value":"El complemento Migration, Backup, Staging – WPvivid para WordPress es vulnerable a Directory Traversal en versiones hasta la 0.9.89 incluida. Esto permite a atacantes autenticados con privilegios administrativos eliminar el contenido de directorios arbitrarios en el servidor, lo que puede ser un problema crítico en entornos compartidos."}],"id":"CVE-2023-4274","lastModified":"2026-06-17T06:37:27.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"security@wordfence.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-4274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-02-05T18:23:20.219168Z","version":"2.0.3"}}]},"published":"2023-10-20T07:15:15.537","references":[{"source":"security@wordfence.com","tags":["Exploit"],"url":"https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200"},{"source":"security@wordfence.com","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","tags":["Patch","Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"url":"https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail="},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"nvd@nist.gov","type":"Primary"}]}
|