CVE-2024-4389
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload
Published Aug 14, 2024
CVSS 3.1 · 8.8 High
EPSS 1.0%
KEV · Not listed
Description
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| averta | Depicter — Popup & Slider Builder | unaffected |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-44022 | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible. |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 1.0% (1.021% probability within 30 days)
Exploitation none
Automatable no
Technical Impact total
References
History
Aug 14, 2024 2:30 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Averta
Averta add Image Slider Averta carousel Slider Averta coupon Popup Averta exit Intent Popup Averta popup Modal Averta post Slider Carousel Averta slider And Popup Builder By Depicter |
|
| CPEs | cpe:2.3:a:averta:add_image_slider:*:*:*:*:*:*:*:* cpe:2.3:a:averta:carousel_slider:*:*:*:*:*:*:*:* cpe:2.3:a:averta:coupon_popup:*:*:*:*:*:*:*:* cpe:2.3:a:averta:exit_intent_popup:*:*:*:*:*:*:*:* cpe:2.3:a:averta:popup_modal:*:*:*:*:*:*:*:* cpe:2.3:a:averta:post_slider_carousel:*:*:*:*:*:*:*:* cpe:2.3:a:averta:slider_and_popup_builder_by_depicter:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Averta
Averta add Image Slider Averta carousel Slider Averta coupon Popup Averta exit Intent Popup Averta popup Modal Averta post Slider Carousel Averta slider And Popup Builder By Depicter |
|
| Metrics |
ssvc
|
Aug 14, 2024 8:45 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible. | |
| Title | Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload | |
| Weaknesses | CWE-434 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Subscriptions
Weaknesses
