CVE-2024-13117 - Vulnerability Details - OpenCVE

The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00214.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Artlosk	Share Buttons

Configuration 1 [-]

cpe:2.3:a:artlosk:share_buttons:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-51357	The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/

History

Tue, 13 May 2025 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Artlosk Artlosk share Buttons
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:artlosk:share_buttons::::::wordpress::*
Vendors & Products		Artlosk Artlosk share Buttons

Mon, 03 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Jan 2025 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded
Title		Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal
References		https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-01-27T06:00:12.163Z

Updated: 2025-02-03T14:29:29.172Z

Reserved: 2025-01-01T14:57:26.294Z

Link: CVE-2024-13117

Vulnrichment

Updated: 2025-01-27T14:25:01.525Z

NVD

Status : Analyzed

Published: 2025-01-27T06:15:23.637

Modified: 2025-05-13T20:59:51.320

Link: CVE-2024-13117

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13117", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-01-01T14:57:26.294Z", "datePublished": "2025-01-27T06:00:12.163Z", "dateUpdated": "2025-02-03T14:29:29.172Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-01-27T06:00:12.163Z"}, "title": "Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal", "problemTypes": [{"descriptions": [{"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Social Share Buttons for WordPress", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "2.7"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded"}], "references": [{"url": "https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bob Matyas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-27T14:24:35.614554Z", "id": "CVE-2024-13117", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T14:29:29.172Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13117", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-27T14:24:35.614554Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-27T14:25:01.525Z"}}], "cna": {"title": "Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob Matyas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Social Share Buttons for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7"}], "defaultStatus": "affected"}], "references": [{"url": "https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-01-27T06:00:12.163Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13117", "state": "PUBLISHED", "dateUpdated": "2025-02-03T14:29:29.172Z", "dateReserved": "2025-01-01T14:57:26.294Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-01-27T06:00:12.163Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}