VulnerabilityModified

CVE-2014-8336

The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT…

MEDIUM 6.5EPSS 2.60%

Does this matter?

Lower severity and a low EPSS score (2.60%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 2.60% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: wp-dbmanager project/wp-dbmanager
Source: cve@mitre.org

References

http://www.openwall.com/lists/oss-security/2014/10/21/3Issue Tracking, Mailing List, Patch, Third Party Advisory
http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.htmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97694Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4aIssue Tracking, Patch, Third Party Advisory
https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/10/21/3Issue Tracking, Mailing List, Patch, Third Party Advisory
http://www.vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.htmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/97694Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/lesterchan/wp-dbmanager/commit/7037fa8f61644098044379190d1d4bf1883b8e4aIssue Tracking, Patch, Third Party Advisory
https://wordpress.org/plugins/wp-dbmanager/#developersThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.