9.0crit
CVE-2008-2392in critical feed
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
9.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.3%
percentile 91%
Public exploits
0
none known
Summary
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
Exploit prediction (EPSS)
4.28% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
- CWE-20 Improper Input Validation
- Technology feeds
- WordPress (RSS, critical only)
References
- securityreason.com /securityalert/3897 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /archive/1/492230/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/29276 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/42561 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2008-2392
- NVD: CVE-2008-2392
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.