CVE-2024-4359

Katalog CVE

CVSS 6.5 · Medium EPSS 0,50%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada bdthemes element pack. Skor CVSS 3.1 6.5 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the render_svg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Rincian

Terbit di NVD

12 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/a55cfeb3-7632-4a88-ac71-8e119b060721?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/changeset/3133714/bdthemes-element-pack-lite/trunk/modules/svg-image/widget...