NVD Vulnerability Detail

CVE-2019-14205

Summary	A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
Publication Date	July 22, 2019, 3:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:26 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:nevma:adaptive_images::::::wordpress::*					0.6.67

Related information, measures and tools

No	URL	タグ
1	https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown	Exploit Third Party Advisory
2	https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown	Exploit Third Party Advisory
3	https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html	Exploit Third Party Advisory
4	https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html	Exploit Third Party Advisory
5	https://wordpress.org/plugins/adaptive-images/#developers	Release Notes Third Party Advisory
6	https://wordpress.org/plugins/adaptive-images/#developers	Release Notes Third Party Advisory
7	https://wpvulndb.com/vulnerabilities/9468	Exploit Third Party Advisory
8	https://wpvulndb.com/vulnerabilities/9468	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

WordPress 用 Nevma Adaptive Images プラグインにおける情報漏えいに関する脆弱性

Title	WordPress 用 Nevma Adaptive Images プラグインにおける情報漏えいに関する脆弱性
Summary	WordPress 用 Nevma Adaptive Images プラグインには、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 11, 2019, midnight
Registration Date	July 30, 2019, 2:26 p.m.
Last Update	July 30, 2019, 2:26 p.m.

Affected System

Nevma

Adaptive Images 0.6.67 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-14205	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14205
National Vulnerability Database (NVD)
2	CVE-2019-14205	https://nvd.nist.gov/vuln/detail/CVE-2019-14205

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
WordPress Plugin Directory
1	Adaptive Images for WordPress	https://wordpress.org/plugins/adaptive-images/#developers

その他

No	Name	URL
関連文書
1	Adaptive images for Wordpress 0.6.66: LFI, arbitrary file deletion and RCE.	https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html

Change Log

No	Changed Details	Date of change
1	[2019年07月30日] 掲載	July 30, 2019, 2:26 p.m.