CVE-2022-31475: GiveWP (WordPress plugin), заобикаляне на вход и права

Описание

Оригинално описание

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

Засегнати продукти

• GiveWP GiveWP (WordPress plugin): <= 2.20.2 до 2.20.2

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория
• CWE-552 Files or Directories Accessible to External Parties
• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в GiveWP GiveWP (WordPress plugin)

• 9.1CVE-2022-28700

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-31475
• https://nvd.nist.gov/vuln/detail/CVE-2022-31475
• https://wordpress.org/plugins/give/#developers
• https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-read-via-export-function-vulnerability