CVE-2012-3588

Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitr… (CVE-2012-3588)

Description

Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

Source: CVELISTV5 NVD

Metrics

Severity

none

57.31

—

no public PoC known

—

—

—

95.5 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

10.7 %

Elevated — model estimates 10-50% exploitation likelihood.

Published

2012-06-19 20:00 UTC

CWE

—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

wordpress
plugin_newsletter_plugin

References & sources

http://secunia.com/advisories/49464
third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/76171
vdb-entryx_refsource_XF
http://www.exploit-db.com/exploits/19018
exploitx_refsource_EXPLOIT-DB
http://www.opensyscom.fr/Actualites/wordpress-plugins-plugin-newsletter-remote-file-disclosure-vulnerability.html
x_refsource_MISC

IDCVE-2012-3588