2023-05-16 20:00:39 +00:00
{
2023-05-17 09:00:40 +00:00
"data_version" : "4.0" ,
2023-05-16 20:00:39 +00:00
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"CVE_data_meta" : {
"ID" : "CVE-2023-2745" ,
2023-05-17 09:00:40 +00:00
"ASSIGNER" : "security@wordfence.com" ,
"STATE" : "PUBLIC"
2023-05-16 20:00:39 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2023-05-17 09:00:40 +00:00
"value" : "WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the \u2018wp_lang\u2019 parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack."
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
}
]
}
]
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "WordPress Foundation" ,
"product" : {
"product_data" : [
{
"product_name" : "WordPress" ,
"version" : {
"version_data" : [
{
"version_affected" : "<=" ,
"version_name" : "*" ,
"version_value" : "4.1"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.1" ,
"version_value" : "4.1.38"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.2" ,
"version_value" : "4.2.35"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.3" ,
"version_value" : "4.3.31"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.4" ,
"version_value" : "4.4.30"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.5" ,
"version_value" : "4.5.29"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.6" ,
"version_value" : "4.6.26"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.7" ,
"version_value" : "4.7.26"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.8" ,
"version_value" : "4.8.22"
} ,
{
"version_affected" : "<" ,
"version_name" : "4.9" ,
"version_value" : "4.9.23"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.0" ,
"version_value" : "5.0.19"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.1" ,
"version_value" : "5.1.16"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.2" ,
"version_value" : "5.2.18"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.3" ,
"version_value" : "5.3.15"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.4" ,
"version_value" : "5.4.13"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.5" ,
"version_value" : "5.5.12"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.6" ,
"version_value" : "5.6.11"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.7" ,
"version_value" : "5.7.9"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.8" ,
"version_value" : "5.8.7"
} ,
{
"version_affected" : "<" ,
"version_name" : "5.9" ,
"version_value" : "5.9.6"
} ,
{
"version_affected" : "<" ,
"version_name" : "6.0" ,
"version_value" : "6.0.4"
} ,
{
"version_affected" : "<" ,
"version_name" : "6.1" ,
"version_value" : "6.1.2"
} ,
{
"version_affected" : "<" ,
"version_name" : "6.2" ,
"version_value" : "6.2.1"
}
]
}
}
]
}
}
]
}
} ,
"references" : {
"reference_data" : [
{
"url" : "https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve" ,
"refsource" : "MISC" ,
"name" : "https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=cve"
} ,
{
"url" : "https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/" ,
"refsource" : "MISC" ,
"name" : "https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/"
} ,
{
"url" : "https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail=" ,
"refsource" : "MISC" ,
"name" : "https://core.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=55765%40%2F&new=55765%40%2F&sfp_email=&sfph_mail="
2023-05-17 17:00:40 +00:00
} ,
{
"url" : "http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html" ,
"refsource" : "MISC" ,
"name" : "http://packetstormsecurity.com/files/172426/WordPress-Core-6.2-XSS-CSRF-Directory-Traversal.html"
2023-06-21 01:00:40 +00:00
} ,
{
"url" : "https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html" ,
"refsource" : "MISC" ,
"name" : "https://lists.debian.org/debian-lts-announce/2023/06/msg00024.html"
2023-05-17 09:00:40 +00:00
}
]
} ,
"credits" : [
{
"lang" : "en" ,
"value" : "Ramuel Gall"
} ,
{
"lang" : "en" ,
"value" : "Matt Rusnak"
}
] ,
"impact" : {
"cvss" : [
{
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" ,
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM"
2023-05-16 20:00:39 +00:00
}
]
}
}
