CVE-2024-4258

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4258
The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:yotuwp:video_gallery:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 09:42

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 - Patch () https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve - Third Party Advisory

20 Sep 2024, 00:21

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 - () https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve - Third Party Advisory
CWE NVD-CWE-Other
First Time Yotuwp video Gallery
Yotuwp
CPE cpe:2.3:a:yotuwp:video_gallery:*:*:*:*:*:wordpress:*:*

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) El complemento Video Gallery – YouTube Playlist, Channel Gallery by YotuWP para WordPress es vulnerable a la inclusión de archivos locales en todas las versiones hasta la 1.3.13 incluida a través del parámetro de configuración. Esto hace posible que atacantes no autenticados incluyan y ejecuten archivos arbitrarios en el servidor, permitiendo la ejecución de cualquier código PHP en esos archivos. Esto se puede utilizar para eludir los controles de acceso, obtener datos confidenciales o lograr la ejecución de código en los casos en que se puedan cargar e incluir imágenes y otros tipos de archivos "seguros".

15 Jun 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-15 09:15

Updated : 2024-11-21 09:42

NVD link : CVE-2024-4258

Mitre link : CVE-2024-4258

CVE.ORG link : CVE-2024-4258

JSON object : View

Products Affected

yotuwp

  • video_gallery
CWE
NVD-CWE-Other