CVE-2023-1427

Published Apr 17, 2023

Last updated a year ago

Overview

Description: - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.9
Impact score: 3.6
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9CABF93C-D672-4711-AA74-F220C571EED2",
            "versionEndExcluding": "1.8.15"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References