10Web Image Optimizer Plugin up to 1.0.26 on WordPress AJAX Action get_subdirs dir path traversal

Summaryinfo

A vulnerability classified as critical was found in 10Web Image Optimizer Plugin up to 1.0.26 on WordPress. This affects the function get_subdirs of the component AJAX Action Handler. Executing a manipulation of the argument dir can lead to path traversal. This vulnerability appears as CVE-2023-2117. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in 10Web Image Optimizer Plugin up to 1.0.26 on WordPress (WordPress Plugin) and classified as critical. This vulnerability affects the function get_subdirs of the component AJAX Action Handler. The manipulation of the argument dir with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

The weakness was presented 05/30/2023. The advisory is shared for download at wpscan.com. This vulnerability was named CVE-2023-2117 since 04/17/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 1.0.27 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• 10Web

Name

• Image Optimizer Plugin

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion