CVE-2018-8719

MEDIUMNuclei

WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-8719 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information DisclosureExploitDB exploitby Colette ChamberlandNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress WP Security Audit Log 3.1.1 - Information DisclosureCVSS 5.3

WordPress WP Security Audit Log 3.1.1 plugin is susceptible to information disclosure. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the WordPress WP Security Audit Log plugin.

Remediation

Update to the latest version of WordPress WP Security Audit Log plugin (3.1.2 or higher) to fix the information disclosure vulnerability.

WeaknessesCWE-532
AuthorsLogicalHunter
Template tagscvecve2018exposureedbwordpresswp-pluginwpsecurityauditlogvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:wpsecurityauditlog:wp_security_audit_log:3.1.1:*:*:*:*:wordpress:*:*
https://www.exploit-db.com/exploits/44371 https://vuldb.com/?id.115817 https://www.exploit-db.com/exploits/44371/ https://nvd.nist.gov/vuln/detail/CVE-2018-8719 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2