CVE-2023-6971

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php	Patch
https://plugins.trac.wordpress.org/changeset/3012745/backup-backup	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve	Patch Third Party Advisory
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php	Patch
https://plugins.trac.wordpress.org/changeset/3012745/backup-backup	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2023-12-23 02:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6971

Mitre link : CVE-2023-6971

CVE.ORG link : CVE-2023-6971

JSON object : View

Products Affected

backupbliss

backup_migration

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2023-6971", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-12-23T02:15:45.150", "references": [{"url": "https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3012745/backup-backup", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve", "tags": ["Patch", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://plugins.trac.wordpress.org/changeset/3012745/backup-backup", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP."}, {"lang": "es", "value": "El complemento Backup Migration para WordPress es vulnerable a la inclusi\u00f3n remota de archivos en las versiones 1.0.8 a 1.3.9 a trav\u00e9s del encabezado HTTP 'content-dir'. Esto hace posible que atacantes no autenticados incluyan archivos remotos en el servidor, lo que resulta en la ejecuci\u00f3n de c\u00f3digo. NOTA: La explotaci\u00f3n exitosa de esta vulnerabilidad requiere que el php.ini del servidor de destino est\u00e9 configurado con 'allow_url_include' establecido en 'on'. Esta caracter\u00edstica est\u00e1 obsoleta a partir de PHP 7.4 y est\u00e1 deshabilitada de forma predeterminada, pero a\u00fan se puede habilitar expl\u00edcitamente en versiones posteriores de PHP."}], "lastModified": "2024-11-21T08:44:57.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1993F97A-3A3B-4B8F-A573-0E56DC5AD525", "versionEndExcluding": "1.4.0", "versionStartIncluding": "1.0.8"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}