WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| WordPress Foundation | WordPress | < 4.1.38, 4.2 – < 4.2.35, 4.3 – < 4.3.31, 4.4 – < 4.4.30, 4.5 – < 4.5.29, 4.6 – < 4.6.26, 4.7 – < 4.7.26, 4.8 – < 4.8.22, 4.9 – < 4.9.23, 5.0 – < 5.0.19, 5.1 – < 5.1.16, 5.2 – < 5.2.18, 5.3 – < 5.3.15, 5.4 – < 5.4.13, 5.5 – < 5.5.12, 5.6 – < 5.6.11, 5.7 – < 5.7.9, 5.8 – < 5.8.7, 5.9 – < 5.9.6, 6.0 – < 6.0.4, 6.1 – < 6.1.2, 6.2 – < 6.2.1 |
Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.
