CVE-2012-4920: Path Traversal
Published Apr 4, 2014
·Updated
Directory traversal vulnerability in the zingforumoutput function in forum.php in the Zingiri Forum (aka Forums) plugin before 1.4.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter to index.php.
Affected Software
42 affected components
Zingiri Forums<=1.4.3
Zingiri Forums=1.0.0
Zingiri Forums=1.0.1
Zingiri Forums=1.0.2
Zingiri Forums=1.0.3
Zingiri Forums=1.0.4
Zingiri Forums=1.0.5
Zingiri Forums=1.0.6
Zingiri Forums=1.0.7
Zingiri Forums=1.0.8
Zingiri Forums=1.0.9
Zingiri Forums=1.1.0
Zingiri Forums=1.1.1
Zingiri Forums=1.2.0
Zingiri Forums=1.2.1
Zingiri Forums=1.3.0
Zingiri Forums=1.3.1
Zingiri Forums=1.4.0
Zingiri Forums=1.4.1
Zingiri Forums=1.4.2
WordPress
All of the following
Any of the following
Zingiri Forums<=1.4.3
Zingiri Forums=1.0.0
Zingiri Forums=1.0.1
Zingiri Forums=1.0.2
Zingiri Forums=1.0.3
Zingiri Forums=1.0.4
Zingiri Forums=1.0.5
Zingiri Forums=1.0.6
Zingiri Forums=1.0.7
Zingiri Forums=1.0.8
Zingiri Forums=1.0.9
Zingiri Forums=1.1.0
Zingiri Forums=1.1.1
Zingiri Forums=1.2.0
Zingiri Forums=1.2.1
Zingiri Forums=1.3.0
Zingiri Forums=1.3.1
Zingiri Forums=1.4.0
Zingiri Forums=1.4.1
Zingiri Forums=1.4.2
WordPress
Remediation
Patch Available
Event History
Apr 4, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-4920?
CVE-2012-4920 is rated as a high-severity vulnerability due to its potential to allow unauthorized file access.
2
How do I fix CVE-2012-4920?
To fix CVE-2012-4920, update the Zingiri Forum plugin to version 1.4.4 or later.
3
Who is affected by CVE-2012-4920?
CVE-2012-4920 affects all versions of the Zingiri Forum plugin prior to 1.4.4 for WordPress.
4
What type of vulnerability is CVE-2012-4920?
CVE-2012-4920 is a directory traversal vulnerability that can be exploited by attackers to read arbitrary files.
5
Can CVE-2012-4920 be exploited remotely?
Yes, CVE-2012-4920 can be exploited remotely via crafted URL parameters.