CVE-2017-14722 — Path Traversal in Wordpress

CWE-22 — Path Traversal4 documents4 sources
Severity
7.5HIGHNVD
EPSS
30.5%
top 3.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedSep 23
Latest updateMay 17

Description

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 4.8.2+dfsg-1 (bookworm)
▶Debianwordpress/wordpress< 4.8.2+dfsg-1+3
▶NVDwordpress/wordpress8 versions+7

Patches

Patch: core.trac.wordpress.org ↗Patch: wordpress.org ↗Patch: wpvulndb.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c3x3-frh6-qx5w: Before version 4↗2022-05-17
▶
OSV
CVE-2017-14722: Before version 4↗2017-09-23
▶

📋Vendor Advisories

1
Debian
CVE-2017-14722: wordpress - Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Cust...↗2017
▶
CVE-2017-14722 — Path Traversal in Debian Wordpress | cvebase