Plattform
wordpress
Komponente
pdf-rechnungsverwaltung
Behoben in
0.0.2
CVE-2024-49287 describes a Path Traversal vulnerability within the PDF-Rechnungsverwaltung WordPress plugin. This flaw allows attackers to potentially include arbitrary files on the server, leading to sensitive data disclosure or even remote code execution. The vulnerability impacts versions of PDF-Rechnungsverwaltung up to and including 0.0.1, and a fix is available in version 0.0.2.
The core of this vulnerability lies in the improper handling of file paths within the PDF-Rechnungsverwaltung plugin. An attacker can craft malicious requests that manipulate the pathname, bypassing intended restrictions and accessing files outside the designated directory. Successful exploitation could allow an attacker to read sensitive configuration files, source code, or even execute arbitrary PHP code on the server. This could lead to complete compromise of the WordPress instance and potentially the underlying server infrastructure. The impact is amplified if the server hosts other sensitive applications or data.
CVE-2024-49287 was publicly disclosed on 2024-10-17. Currently, there are no known active campaigns targeting this vulnerability, and no public proof-of-concept exploits have been released. The vulnerability is not listed on the CISA KEV catalog at the time of this writing. The HIGH CVSS score reflects the potential for significant impact if exploited.
WordPress websites utilizing the PDF-Rechnungsverwaltung plugin, particularly those running versions prior to 0.0.2, are at risk. Shared hosting environments where users have limited control over plugin configurations are especially vulnerable, as are systems with weak file access permissions.
• wordpress / composer / npm:
grep -r "../" /var/www/html/wp-content/plugins/pdf-rechnungsverwaltung/*• generic web:
curl -I 'http://your-wordpress-site.com/wp-content/plugins/pdf-rechnungsverwaltung/../../../../etc/passwd' # Attempt to access sensitive filesdisclosure
Exploit-Status
EPSS
0.33% (56% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-49287 is to immediately upgrade the PDF-Rechnungsverwaltung plugin to version 0.0.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file access permissions on the server. Specifically, ensure that the web server user has minimal privileges and can only access necessary files. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal patterns (e.g., '../'). After upgrading, confirm the fix by attempting to access a file outside the intended directory through the plugin's interface; access should be denied.
Actualice el plugin PDF-Rechnungsverwaltung a una versión posterior a la 0.0.1. Si no hay una versión disponible, considere desinstalar el plugin hasta que se publique una versión corregida. Consulte la página del plugin en WordPress.org para obtener actualizaciones.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-49287 is a Path Traversal vulnerability affecting PDF-Rechnungsverwaltung versions up to 0.0.1, allowing attackers to potentially include arbitrary files on the server.
You are affected if you are using PDF-Rechnungsverwaltung version 0.0.1 or earlier. Upgrade to version 0.0.2 to resolve the vulnerability.
Upgrade PDF-Rechnungsverwaltung to version 0.0.2 or later. If immediate upgrade is not possible, implement temporary workarounds like WAF rules or file permission restrictions.
There is currently no evidence of CVE-2024-49287 being actively exploited in the wild.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and release notes regarding this vulnerability.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.