CVE-2021-39327

Katalog CVE

CVSS 5.3 · Medium EPSS 71,7%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada ait-pro bulletproof security. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

Rincian

Terbit di NVD

17 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-459: Incomplete Cleanup

EPSS (30 hari)

71,7% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-securit... patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327 exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/50382 exploit · advisory pihak ketiga · vdb entry
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 advisory pihak ketiga