CVE-2022-0679

Katalog CVE

CVSS 9.8 · Critical EPSS 47,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada narnoo distributor project narnoo distributor. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.

Rincian

Terbit di NVD

28 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

47,8% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/0ea79eb1-6561-4c21-a20b-a1870863b0a8 exploit · advisory pihak ketiga