← Back to CVEs

CVE-2023-2068

CRITICAL

9.8

Description

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/27/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

advancedfilemanager:file_manager_advanced_shortcode

References

http://packetstormsecurity.com/files/173735/WordPress-File-Manager-Advanced-Shortcode-2.3.2-Remote-Code-Execution.html(contact@wpscan.com)

https://wpscan.com/vulnerability/58f72953-56d2-4d86-a49b-311b5fc58056(contact@wpscan.com)

http://packetstormsecurity.com/files/173735/WordPress-File-Manager-Advanced-Shortcode-2.3.2-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/58f72953-56d2-4d86-a49b-311b5fc58056(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.