CVE-2024-10011

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codex.buddypress.org/releases/version-14-2-1/	Release Notes
https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270	Product
https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370	Product
https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1&old=3102524&old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php	Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-10-25 07:15

Updated : 2024-11-06 16:01

NVD link : CVE-2024-10011

Mitre link : CVE-2024-10011

CVE.ORG link : CVE-2024-10011

JSON object : View

Products Affected

buddypress

buddypress

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-10011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-10-25T07:15:02.637", "references": [{"url": "https://codex.buddypress.org/releases/version-14-2-1/", "tags": ["Release Notes"], "source": "security@wordfence.com"}, {"url": "https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1270", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://github.com/buddypress/buddypress/blob/master/src/bp-core/bp-core-avatars.php#L1370", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3173924/buddypress/trunk/bp-core/bp-core-avatars.php?contextall=1&old=3102524&old_path=%2Fbuddypress%2Ftrunk%2Fbp-core%2Fbp-core-avatars.php", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions. This vulnerability only affects Windows."}, {"lang": "es", "value": "El complemento BuddyPress para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 14.1.0 incluida a trav\u00e9s del par\u00e1metro id. Esto permite que atacantes autenticados, con acceso de nivel de suscriptor y superior, realicen acciones en archivos fuera del directorio originalmente previsto y permite cargar archivos en directorios fuera de la ra\u00edz web. Seg\u00fan la configuraci\u00f3n del servidor, es posible cargar archivos con doble extensi\u00f3n. Esta vulnerabilidad solo afecta a Windows."}], "lastModified": "2024-11-06T16:01:39.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "FCFCCBD4-7F7F-4585-8331-BF8343397BDC", "versionEndIncluding": "14.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}