CVE-2024-10011 (GCVE-0-2024-10011)
Vulnerability from cvelistv5
Published
2024-10-25 06:51
Modified
2024-10-25 14:11
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows.
References
security@wordfence.comhttps://codex.buddypress.org/releases/version-14-2-1/Release Notes
security@wordfence.comhttps://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270Product
security@wordfence.comhttps://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370Product
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1&old=3102524&old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.phpProduct
security@wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cveThird Party Advisory
Impacted products
Vendor Product Version
buddypress BuddyPress Version: *   ≤ 14.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "buddypress",
            "vendor": "buddypress",
            "versions": [
              {
                "lessThanOrEqual": "14.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T14:09:31.780200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T14:11:50.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BuddyPress",
          "vendor": "buddypress",
          "versions": [
            {
              "lessThanOrEqual": "14.1.0",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Domons"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-25T06:51:24.333Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve"
        },
        {
          "url": "https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370"
        },
        {
          "url": "https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270"
        },
        {
          "url": "https://codex.buddypress.org/releases/version-14-2-1/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1\u0026old=3102524\u0026old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-24T17:56:55.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "BuddyPress \u003c= 14.1.0 - Authenticated (Subscriber+) Directory Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-10011",
    "datePublished": "2024-10-25T06:51:24.333Z",
    "dateReserved": "2024-10-15T21:48:03.764Z",
    "dateUpdated": "2024-10-25T14:11:50.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-10011\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2024-10-25T07:15:02.637\",\"lastModified\":\"2024-11-06T16:01:39.573\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows.\"},{\"lang\":\"es\",\"value\":\"El complemento BuddyPress para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 14.1.0 incluida a trav\u00e9s del par\u00e1metro id. Esto permite que atacantes autenticados, con acceso de nivel de suscriptor y superior, realicen acciones en archivos fuera del directorio originalmente previsto y permite cargar archivos en directorios fuera de la ra\u00edz web. Seg\u00fan la configuraci\u00f3n del servidor, es posible cargar archivos con doble extensi\u00f3n. Esta vulnerabilidad solo afecta a Windows.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*\",\"versionEndIncluding\":\"14.1.0\",\"matchCriteriaId\":\"FCFCCBD4-7F7F-4585-8331-BF8343397BDC\"}]}]}],\"references\":[{\"url\":\"https://codex.buddypress.org/releases/version-14-2-1/\",\"source\":\"security@wordfence.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270\",\"source\":\"security@wordfence.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370\",\"source\":\"security@wordfence.com\",\"tags\":[\"Product\"]},{\"url\":\"https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1\u0026old=3102524\u0026old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php\",\"source\":\"security@wordfence.com\",\"tags\":[\"Product\"]},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve\",\"source\":\"security@wordfence.com\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2024-10-25T06:51:24.333Z\"}, \"affected\": [{\"vendor\": \"buddypress\", \"product\": \"BuddyPress\", \"versions\": [{\"version\": \"*\", \"status\": \"affected\", \"lessThanOrEqual\": \"14.1.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows.\"}], \"title\": \"BuddyPress \u003c= 14.1.0 - Authenticated (Subscriber+) Directory Traversal\", \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve\"}, {\"url\": \"https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370\"}, {\"url\": \"https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270\"}, {\"url\": \"https://codex.buddypress.org/releases/version-14-2-1/\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1\u0026old=3102524\u0026old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"cweId\": \"CWE-22\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\"}}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Domons\"}], \"timeline\": [{\"time\": \"2024-10-24T17:56:55.000+00:00\", \"lang\": \"en\", \"value\": \"Disclosed\"}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-10011\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-25T14:09:31.780200Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*\"], \"vendor\": \"buddypress\", \"product\": \"buddypress\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"14.1.0\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-25T14:11:44.987Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-10011\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Wordfence\", \"dateReserved\": \"2024-10-15T21:48:03.764Z\", \"datePublished\": \"2024-10-25T06:51:24.333Z\", \"dateUpdated\": \"2024-10-25T14:11:50.388Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.