Plattform
wordpress
Komponente
ssv-mailchimp
Behoben in
3.1.6
CVE-2024-49285 identifies a Path Traversal vulnerability within the SSV MailChimp WordPress plugin. This flaw allows attackers to potentially include arbitrary files on the server, leading to sensitive data exposure or even remote code execution. The vulnerability impacts versions of SSV MailChimp up to and including 3.1.5, and a patch is available in version 3.1.6.
The core impact of CVE-2024-49285 lies in its ability to facilitate PHP Local File Inclusion. An attacker can exploit this by manipulating file paths to access arbitrary files on the server's filesystem. This could include configuration files containing database credentials, sensitive application code, or other confidential data. Successful exploitation could lead to unauthorized access to sensitive information, potential code execution if the attacker can include and execute malicious PHP code, and ultimately, a compromise of the entire WordPress installation. While no direct precedent for this specific vulnerability exists, Path Traversal vulnerabilities are frequently exploited to gain unauthorized access to system resources.
CVE-2024-49285 was publicly disclosed on 2024-10-17. The vulnerability's severity is rated HIGH (CVSS 7.5). Currently, there are no publicly available proof-of-concept exploits, and no reports of active exploitation campaigns. It is not listed on the CISA KEV catalog at the time of this writing.
WordPress websites utilizing the SSV MailChimp plugin, particularly those running versions 3.1.5 or earlier, are at risk. Shared hosting environments are particularly vulnerable as they often have limited control over server file permissions. Websites with misconfigured file permissions or inadequate input validation are also at increased risk.
• wordpress / composer / npm:
grep -r "../" /var/www/html/wp-content/plugins/ssv-mailchimp/*• generic web:
curl -I http://your-wordpress-site.com/wp-content/plugins/ssv-mailchimp/../../../../etc/passwd• wordpress / composer / npm:
wp plugin list --status=inactive | grep ssv-mailchimp• wordpress / composer / npm:
wp plugin update ssv-mailchimpdisclosure
Exploit-Status
EPSS
0.40% (61% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-49285 is to immediately upgrade SSV MailChimp to version 3.1.6 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider implementing temporary workarounds. These might include restricting file permissions on sensitive files to prevent unauthorized access, or implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal patterns (e.g., '../'). Monitor WordPress access logs for unusual file access attempts. After upgrading, verify the fix by attempting to access a non-existent file via the vulnerable endpoint and confirming that access is denied.
Actualiza el plugin SSV MailChimp a la última versión disponible. Si no hay una versión disponible que corrija la vulnerabilidad, considera deshabilitar el plugin hasta que se publique una actualización. Mantén tus plugins actualizados para evitar vulnerabilidades de seguridad.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-49285 is a Path Traversal vulnerability in SSV MailChimp allowing attackers to potentially include arbitrary files, leading to sensitive data exposure or code execution.
You are affected if you are using SSV MailChimp versions 3.1.5 or earlier. Upgrade to 3.1.6 to mitigate the risk.
Upgrade to SSV MailChimp version 3.1.6 or later. If immediate upgrade is not possible, implement temporary workarounds like restricting file access and using a WAF.
There is currently no indication of active exploitation campaigns, but the vulnerability's nature suggests potential for future exploitation.
Refer to the official SSV MailChimp website or WordPress plugin repository for the latest advisory and update information.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.