プラットフォーム
wordpress
コンポーネント
ssv-events
修正版
3.2.8
CVE-2024-49286 describes a Remote Code Execution (RCE) vulnerability within the Moridrin SSV Events WordPress plugin. This flaw, stemming from improper limitation of a pathname, allows attackers to leverage PHP Local File Inclusion. Versions of SSV Events up to and including 3.2.7 are affected, and a patch is available in version 3.2.8.
The vulnerability allows an attacker to include arbitrary files on the server, leading to complete system compromise. By crafting malicious requests, an attacker can read sensitive configuration files, execute arbitrary code, and potentially gain persistent access to the WordPress environment. This could result in data theft, website defacement, or the installation of malware. The impact is particularly severe due to the plugin's potential access to sensitive event data and user information.
This vulnerability was publicly disclosed on 2024-10-20. While no active exploitation campaigns have been definitively linked to CVE-2024-49286 at the time of writing, the RCE nature and ease of exploitation make it a high-priority target. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the vulnerability's simplicity.
WordPress sites utilizing the Moridrin SSV Events plugin, particularly those running versions 3.2.7 or earlier, are at significant risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable, as are sites with weak file permission configurations.
• wordpress / composer / npm:
grep -r "../../" /var/www/html/wp-content/plugins/ssv-events/• generic web:
curl -I 'http://your-wordpress-site.com/wp-content/plugins/ssv-events/../../../../etc/passwd'• wordpress / composer / npm:
wp plugin list --status=inactive | grep ssv-eventsdisclosure
エクスプロイト状況
EPSS
0.87% (75% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation is to immediately upgrade the Moridrin SSV Events plugin to version 3.2.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file access permissions on the server to limit the potential impact of the vulnerability. Implement a Web Application Firewall (WAF) with rules to block attempts to include files outside the designated directory. Monitor WordPress logs for suspicious file inclusion attempts, specifically looking for unusual file paths in requests. After upgrading, verify the fix by attempting a file inclusion request and confirming that it is blocked.
SSV Events プラグインを最新バージョンにアップデートしてください。リモートコード実行 (RCE) を可能にするローカルファイルインクルージョンの脆弱性は、最新バージョン以前のバージョンに存在します。アップデートすることでこの脆弱性を修正できます。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2024-49286 is a critical Remote Code Execution vulnerability in the Moridrin SSV Events WordPress plugin, allowing attackers to include arbitrary files on the server.
Yes, if you are using Moridrin SSV Events version 3.2.7 or earlier, you are vulnerable to this RCE flaw.
Upgrade the Moridrin SSV Events plugin to version 3.2.8 or later to patch the vulnerability. Consider WAF rules as a temporary workaround.
While no confirmed active exploitation campaigns are currently known, the vulnerability's severity and ease of exploitation suggest it is a high-priority target.
Refer to the Moridrin website and WordPress plugin repository for the latest advisory and update information regarding CVE-2024-49286.
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。