NVD Vulnerability Detail

CVE-2019-8943

Summary	WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
Publication Date	Feb. 20, 2019, 12:29 p.m.
Registration Date	Jan. 26, 2021, 11:45 a.m.
Last Update	Nov. 21, 2024, 1:50 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:wordpress:wordpress::::::::			5.0.3

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
3	http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce	Exploit Third Party Advisory
4	http://www.securityfocus.com/bid/107089	Third Party Advisory VDB Entry
5	https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/	Exploit Third Party Advisory
6	https://www.exploit-db.com/exploits/46511/	Exploit Third Party Advisory VDB Entry
7	https://www.exploit-db.com/exploits/46662/	Exploit Mailing List Third Party Advisory VDB Entry
8	http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html	Exploit Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/46662/	Exploit Mailing List Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/46511/	Exploit Third Party Advisory VDB Entry
11	https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/	Exploit Third Party Advisory
12	http://www.securityfocus.com/bid/107089	Third Party Advisory VDB Entry
13	http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce	Exploit Third Party Advisory
14	http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

WordPress におけるパストラバーサルの脆弱性

Title	WordPress におけるパストラバーサルの脆弱性
Summary	WordPress には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Feb. 19, 2019, midnight
Registration Date	March 28, 2019, 6:12 p.m.
Last Update	March 28, 2019, 6:12 p.m.

Affected System

WordPress.org

WordPress 5.0.3 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-8943	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8943
2	CVE-2019-8943	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8943
National Vulnerability Database (NVD)
3	CVE-2019-8943	https://nvd.nist.gov/vuln/detail/CVE-2019-8943
4	CVE-2019-8943	https://nvd.nist.gov/vuln/detail/CVE-2019-8943

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html
2	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

その他

No	Name	URL
関連文書
1	WordPress 5.0.0 Remote Code Execution	https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
2	WordPress 5.0.0 Remote Code Execution	https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/

Change Log

No	Changed Details	Date of change
1	[2019年03月28日] 掲載	March 28, 2019, 6:12 p.m.
1	[2019年03月28日] 掲載	March 28, 2019, 6:12 p.m.