CVE-2024-0221: Path Traversal
First published: Mon Feb 05 2024(Updated: )
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 10quality Post Gallery | <1.8.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3b8f32-f29d-4e67-8fad-202bfc8a9918?source=cve
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/controller.php#L441
- https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/controller.php#L291
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022981%40photo-gallery%2Ftrunk&old=3013021%40photo-gallery%2Ftrunk&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-0221?
CVE-2024-0221 is classified as a critical vulnerability due to the potential for authenticated attackers to exploit directory traversal to rename arbitrary files on the server.
How do I fix CVE-2024-0221?
To fix CVE-2024-0221, update the Photo Gallery by 10Web plugin to version 1.8.20 or later.
Who is affected by CVE-2024-0221?
CVE-2024-0221 affects all versions of the Photo Gallery by 10Web plugin up to and including version 1.8.19 on WordPress.
What are the consequences of exploiting CVE-2024-0221?
Exploiting CVE-2024-0221 could lead to unauthorized file renaming, potentially compromising web server integrity and data.
Is authentication required to exploit CVE-2024-0221?
Yes, exploitation of CVE-2024-0221 requires authentication, allowing only logged-in users to perform the attack.
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/10web
- canonical/10quality post gallery