10Web Photo Gallery plugin up to 1.5.24 on WordPress admin-ajax.php?action=shortcode_bwg tagtext path traversal

Summaryinfo

A vulnerability labeled as critical has been found in 10Web Photo Gallery plugin up to 1.5.24 on WordPress. Affected by this vulnerability is an unknown functionality of the file wp-admin/admin-ajax.php?action=shortcode_bwg. Executing a manipulation of the argument tagtext can lead to path traversal. The identification of this vulnerability is CVE-2019-14798. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in 10Web Photo Gallery plugin up to 1.5.24 on WordPress (Photo Gallery Software). This vulnerability affects an unknown part of the file wp-admin/admin-ajax.php?action=shortcode_bwg. The manipulation of the argument tagtext with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

The weakness was shared 08/09/2019. This vulnerability was named CVE-2019-14798 since 08/09/2019. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is necessary for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 1.5.25 eliminates this vulnerability.

The entry VDB-139743 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Photo Gallery Software

Vendor

• 10Web

Name

• Photo Gallery plugin

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 1.5.12
• 1.5.13
• 1.5.14
• 1.5.15
• 1.5.16
• 1.5.17
• 1.5.18
• 1.5.19
• 1.5.20
• 1.5.21
• 1.5.22
• 1.5.23
• 1.5.24

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion