CVE-2024-6451 — Log File Information Exposure in AI Engine

CWE-532 — Log File Information ExposureCWE-94 — Code Injection3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.7%
top 28.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Meowapps AI Engine
Timeline
PublishedAug 19

Description

AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages1 packages

▶NVDmeowapps/ai_engine< 2.4.3

🔴Vulnerability Details

2
GHSA
GHSA-q636-fx55-gfr2: AI Engine < 2↗2024-08-19
▶
CVEList
AI Engine < 2.5.1 - Admin+ RCE↗2024-08-19
▶
CVE-2024-6451 — Log File Information Exposure | cvebase