CVE-2014-4941

Nuclei

Cross RSS 1.7 - Local File Inclusion

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2014-4941 has a selected CVSS score of 5.0; EIP currently links 1 Nuclei template.

Description

Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMCross RSS 1.7 - Local File InclusionCVSS 5

Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.

Impact

Attackers can read arbitrary files on the server, potentially exposing sensitive information.

Remediation

Update to the latest version of the plugin that addresses this vulnerability.

WeaknessesCWE-22
AuthorsDhiyaneshDK
Template tagscvecve2014wp-cross-rsswordpresswp-pluginlfiwpvuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:cross-rss_plugin_project:wp-cross-rss:1.7:*:*:*:*:wordpress:*:*
https://wordpress.org/plugins/cross-rss/ https://codevigilant.com/disclosure/wp-plugin-cross-rss-local-file-inclusion/ https://nvd.nist.gov/vuln/detail/CVE-2014-4941

Source: ProjectDiscovery

References

2