CVE-2019-8943

MEDIUM severity · CVSS 6.5 · Path traversal

6.5CVSS MEDIUM

Summary

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)94%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products we track (1)

WordPress

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://www.securityfocus.com/bid/107089Advisory
http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.htmlAdvisory
http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.htmlAdvisory
http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rceAdvisory
https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/Advisory
https://www.exploit-db.com/exploits/46511/Advisory
https://www.exploit-db.com/exploits/46662/Advisory
http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.htmlAdvisory