{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4634", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2023-08-30T13:42:01.959Z", "datePublished": "2023-09-06T08:27:50.147Z", "dateUpdated": "2024-08-02T07:31:06.647Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2023-09-06T08:27:50.147Z"}, "affected": [{"vendor": "dglingren", "product": "Media Library Assistant", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "3.09", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible."}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve"}, {"url": "https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4"}, {"url": "https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/"}, {"url": "https://github.com/Patrowl/CVE-2023-4634/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Pepitoh"}], "timeline": [{"time": "2023-09-05T00:00:00.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:06.647Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve", "tags": ["x_transferred"]}, {"url": "https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4", "tags": ["x_transferred"]}, {"url": "https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/", "tags": ["x_transferred"]}, {"url": "https://github.com/Patrowl/CVE-2023-4634/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "5C1D11EB-8D81-458F-972A-2143B2D66FB7", "versionEndExcluding": "3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible."}, {"lang": "es", "value": "El complemento Media Library Assistant para WordPress es vulnerable a la inclusi\u00f3n de archivos locales y la ejecuci\u00f3n remota de c\u00f3digo en versiones hasta la 3.09 incluida. Esto se debe a controles insuficientes en las rutas de archivo que se suministran al par\u00e1metro 'mla_stream_file' desde el archivo ~/includes/mla-stream-image.php, donde las im\u00e1genes se procesan a trav\u00e9s de Imagick(). Esto hace posible que atacantes no autenticados proporcionen archivos a trav\u00e9s de FTP que har\u00e1n posible las listas de directorios, la inclusi\u00f3n de archivos locales y la ejecuci\u00f3n remota de c\u00f3digo.\n"}], "id": "CVE-2023-4634", "lastModified": "2023-11-07T04:22:48.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2023-09-06T09:15:08.873", "references": [{"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Patrowl/CVE-2023-4634/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified"}

{}