CVE-2023-2745
WordPress Core < 6.2.1 - Directory Traversal
Résumé
WordPress Core < 6.2.1 - Directory Traversal
Description d'origine
La description telle que publiée par la source (souvent en anglais).
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
Paquets affectés
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.38"},{"introduced":"4.2.0"},{"fixed":"4.2.35"},{"introduced":"4.3.0"},{"fixed":"4.3.31"},{"introduced":"4.4.0"},{"fixed":"4.4.30"},{"introduced":"4.5.0"},{"fixed":"4.5.29"},{"introduced":"4.6.0"},{"fixed":"4.6.26"},{"introduced":"4.7.0"},{"fixed":"4.7.26"},{"introduced":"4.8.0"},{"fixed":"4.8.22"},{"introduced":"4.9.0"},{"fixed":"4.9.23"},{"introduced":"5.0.0"},{"fixed":"5.0.19"},{"introduced":"5.1.0"},{"fixed":"5.1.16"},{"introduced":"5.2.0"},{"fixed":"5.2.18"},{"introduced":"5.3.0"},{"fixed":"5.3.15"},{"introduced":"5.4.0"},{"fixed":"5.4.13"},{"introduced":"5.5.0"},{"fixed":"5.5.12"},{"introduced":"5.6.0"},{"fixed":"5.6.11"},{"introduced":"5.7.0"},{"fixed":"5.7.9"},{"introduced":"5.8.0"},{"fixed":"5.8.7"},{"introduced":"5.9.0"},{"fixed":"5.9.6"},{"introduced":"6.0.0"},{"fixed":"6.0.4"},{"introduced":"6.1.0"},{"fixed":"6.1.2"},{"introduced":"6.2.0"},{"fixed":"6.2.1"}]}]
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.38"},{"introduced":"4.2.0"},{"fixed":"4.2.35"},{"introduced":"4.3.0"},{"fixed":"4.3.31"},{"introduced":"4.4.0"},{"fixed":"4.4.30"},{"introduced":"4.5.0"},{"fixed":"4.5.29"},{"introduced":"4.6.0"},{"fixed":"4.6.26"},{"introduced":"4.7.0"},{"fixed":"4.7.26"},{"introduced":"4.8.0"},{"fixed":"4.8.22"},{"introduced":"4.9.0"},{"fixed":"4.9.23"},{"introduced":"5.0.0"},{"fixed":"5.0.19"},{"introduced":"5.1.0"},{"fixed":"5.1.16"},{"introduced":"5.2.0"},{"fixed":"5.2.18"},{"introduced":"5.3.0"},{"fixed":"5.3.15"},{"introduced":"5.4.0"},{"fixed":"5.4.13"},{"introduced":"5.5.0"},{"fixed":"5.5.12"},{"introduced":"5.6.0"},{"fixed":"5.6.11"},{"introduced":"5.7.0"},{"fixed":"5.7.9"},{"introduced":"5.8.0"},{"fixed":"5.8.7"},{"introduced":"5.9.0"},{"fixed":"5.9.6"},{"introduced":"6.0.0"},{"fixed":"6.0.4"},{"introduced":"6.1.0"},{"fixed":"6.1.2"},{"introduced":"6.2.0"},{"fixed":"6.2.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-2745 wordpress Corrigé dans: 5.7.11+dfsg1-0+deb11u1
Références
- advisory nvd.nist.gov
- advisory github.com
- web packetstormsecurity.com
- web core.trac.wordpress.org
- web lists.debian.org
- web wordpress.org
- web wordfence.com
- web exploit-db.com
- web wordfence.com