Description

WordPress Plugin BackupBuddy is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin BackupBuddy version 2.2.28 is vulnerable; other versions may also be affected.

Remediation

Make sure that the file 'importbuddy.php' is removed from the root of the website

References

http://packetstormsecurity.com/files/120923/Backupbuddy-2.2.4-Sensitive-Data-Exposure.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html

Related Vulnerabilities

WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (4.0.2)

WordPress Plugin Woo Custom Checkout Field Multiple Vulnerabilities (1.3.2)

PHP Other Vulnerability (CVE-2015-6835)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-1860)

XOOPS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2006-2516)

Severity

High

Classification

CVE-2013-2743 CVE-2013-2744 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure