Description

WordPress Plugin BackupBuddy is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin BackupBuddy version 2.2.28 is vulnerable; other versions may also be affected.

Remediation

Make sure that the file 'importbuddy.php' is removed from the root of the website

References

http://packetstormsecurity.com/files/120923/Backupbuddy-2.2.4-Sensitive-Data-Exposure.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html

Related Vulnerabilities

WordPress Plugin BuddyPress Global Search Cross-Site Scripting (1.1.0)

Joomla Improper Authentication Vulnerability (CVE-2014-6632)

WordPress Plugin Compact WP Audio Player Multiple Vulnerabilities (1.9.6)

Grafana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-43798)

Liferay Portal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-1503)

Severity

High

Classification

CVE-2013-2743 CVE-2013-2744 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure