CVE-2023-5504

CVSS 3.1 Score 8.7 of 10 (high)

Details

Published Jan 11, 2024
Updated: Jan 17, 2024
CWE ID 22

Summary

CVE-2023-5504 is a vulnerability that affects the BackWPup plugin for WordPress versions up to and including 4.0.1. The vulnerability allows authenticated attackers to perform Directory Traversal via the Log File Folder, enabling them to store backups in arbitrary folders on the server as long as they can be written to by the server. By default, an index.php and .htaccess file will be placed in the chosen directory when the first backup job is run, aiming to prevent directory listing and file access. However, an attacker could exploit this vulnerability by setting the backup directory to the root of another site in a shared environment, effectively disabling that site. The risk score for this vulnerability is 65, with a high base severity rating of 8.7. Remediation actions should include updating the BackWPup plugin to a version that addresses this vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-5504 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options