CVE-2014-8335
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.53% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- wp-dbmanager project/wp-dbmanager
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2014/10/20/7Mailing List
- http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.htmlExploit, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97691VDB Entry
- https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4aIssue Tracking, Patch, Third Party Advisory
- https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory
- http://packetstormsecurity.com/files/128785/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.htmlExploit, Issue Tracking, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2014/10/20/7Mailing List
- http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.htmlExploit, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97691VDB Entry
- https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4aIssue Tracking, Patch, Third Party Advisory
- https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.