CVE-2013-2741
First published: Tue Apr 02 2013(Updated: )
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BackupBuddy | =1.3.4 | |
| BackupBuddy | =2.1.4 | |
| BackupBuddy | =2.2.4 | |
| BackupBuddy | =2.2.25 | |
| BackupBuddy | =2.2.28 | |
| WordPress |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2741?
CVE-2013-2741 has a moderate severity level as it allows unauthorized access to sensitive information in the BackupBuddy plugin.
How do I fix CVE-2013-2741?
To fix CVE-2013-2741, update BackupBuddy to the latest version that requires authentication for sensitive operations.
What versions of BackupBuddy are affected by CVE-2013-2741?
BackupBuddy versions 1.3.4, 2.1.4, 2.2.4, 2.2.25, and 2.2.28 are vulnerable to CVE-2013-2741.
What kind of attacks can exploit CVE-2013-2741?
CVE-2013-2741 can be exploited through direct requests to importbuddy.php to obtain sensitive data or perform unauthorized file operations.
Is WordPress affected by CVE-2013-2741?
WordPress itself is not affected by CVE-2013-2741, but the vulnerable versions of the BackupBuddy plugin can compromise installations.
- agent/type
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ithemes
- canonical/backupbuddy
- version/backupbuddy/1.3.4
- version/backupbuddy/2.1.4
- version/backupbuddy/2.2.4
- version/backupbuddy/2.2.25
- version/backupbuddy/2.2.28
- vendor/wordpress
- canonical/wordpress