WordPress Snap Creek Duplicator Plugin File Download Vulnerability

概要

参考情報

• packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html · Exploit
• packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html · Exploit
• cwe.mitre.org/data/definitions/23.html · Not Applicable
• snapcreek.com/duplicator/docs/changelog · Release Notes
• wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2020-11738

duplicator のその他の脆弱性

• CVE-2018-25095緊急 9.8The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configur…
• CVE-2023-6114高 7.5The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-l…
• CVE-2023-33309中 6.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
• CVE-2022-2552中 5.3The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such…
• CVE-2022-2551高 7.5The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endp…