7.3high
CVE-2019-25215
ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions
Published 2 y ago · modified 4 mo ago · JSON
CVSS
7.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 36%
Public exploits
0
none known
Summary
The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.41% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected products
- arisoft ARI Adminer – WordPress Database Manager
- ari-soft ari_adminer
Classification
- Weakness
- CWE-862 Missing Authorization
References
- wordfence.com /threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve
- plugins.trac.wordpress.org /changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adm
Sources
- CVE List: CVE-2019-25215
- NVD: CVE-2019-25215
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.