VulnerabilityModified

CVE-2014-8606

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a ..

MEDIUM 4.0EPSS 6.04%

Does this matter?

Lower severity and a low EPSS score (6.04%). Track it; it rarely justifies an emergency change on its own.

Description

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.

CVSS 2.0: 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS: 6.04% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: xcloner/xcloner
Source: cve@mitre.org

References

http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/Exploit
http://www.vapid.dhs.org/advisory.php?v=110Exploit
http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/Exploit
http://www.vapid.dhs.org/advisory.php?v=110Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.