Description

WordPress Plugin Vitamin is prone to multiple arbitrary file disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin Vitamin version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.1.0 or latest

References

http://secunia.com/advisories/50176/

http://www.securityfocus.com/bid/54856/

Related Vulnerabilities

WordPress Plugin WP Login Security and History Cross-Site Request Forgery (1.0)

WordPress Plugin Brizy-Page Builder Arbitrary File Upload (2.4.44)

WordPress Plugin Magic Fields Cross-Site Scripting (1.7.1)

WordPress Plugin Yoast SEO Cross-Site Scripting (3.4.0)

TYPO3 URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2010-3661)

Severity

High

Classification

CVE-2012-6651 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure