SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP WordPress Crop Image arbitrary file write attempt
This event is generated when a file is uploaded to a vulnerable version of WP Crop Image Impact: A web shell could be uploaded and lead to a compromise of the server Details: Ease of Attack: very easy
No information provided
No public information
No known false positives
Cisco Talos Intelligence Group
No rule groups
CVE-2019-8943WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. |
|
|||||||||||||||||||||||||||||||
©2023 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
