Lucene search
Veracode Vulnerability DatabaseVERACODE:13367HistoryFeb 21, 2019 - 7:48 a.m.
Arbitrary Code Execution
2019-02-2107:48:00
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
EPSS
0.943
Percentile
99.3%
wordpress is vulnerable to arbitrary code execution. The vulnerability exists in the _wp_attached_file post meta entry when a user with author privilege passes a malicious image with exif metadata causing the Post Meta entry to change to an arbitrary substring such as a .jpg?file.php .
References
packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html
www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
www.securityfocus.com/bid/107088
blog.ripstech.com/2019/wordpress-image-remote-code-execution/
lists.debian.org/debian-lts-announce/2019/03/msg00044.html
wpvulndb.com/vulnerabilities/9222
www.debian.org/security/2019/dsa-4401
www.exploit-db.com/exploits/46511/
www.exploit-db.com/exploits/46662/
Related
patchstack
patchstack
checkpoint_advisories
checkpoint_advisories
WordPress Core Local File Inclusion Remote Code Execution (CVE-2019-8942)
2019-02-20 00:00:00
packetstorm
packetstorm
WordPress 5.0.0 crop-image Shell Upload
2019-04-04 00:00:00
attackerkb
attackerkb
Wordpress Post Meta Entry RCE
2019-02-20 00:00:00
ubuntucve
ubuntucve
CVE-2019-8942
2019-02-20 00:00:00
osv
osv
CVE-2019-8942
2019-02-20 03:29:00
wordpress - security update
2019-04-01 00:00:00
wordpress - security update
2019-03-01 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-1742-1)
2019-04-02 00:00:00
WordPress RCE Vulnerability (CVE-2019-8942) - Linux
2019-02-22 00:00:00
WordPress RCE Vulnerability (CVE-2019-8942) - Windows
2019-02-22 00:00:00
wpvulndb
wpvulndb
WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution
2019-02-19 00:00:00
exploitdb
exploitdb
WordPress Core 5.0.0 - Crop-image Shell Upload (Metasploit)
2019-04-05 00:00:00
WordPress Core 5.0 - Remote Code Execution
2019-03-01 00:00:00
debiancve
debiancve
CVE-2019-8942
2019-02-20 03:29:00
cve
cve
CVE-2019-8942
2019-02-20 03:29:00
nessus
nessus
Debian DLA-1742-1 : wordpress security update
2019-04-01 00:00:00
Debian DSA-4401-1 : wordpress - security update
2019-03-04 00:00:00
prion
prion
Remote code execution
2019-02-20 03:29:00
nvd
nvd
CVE-2019-8942
2019-02-20 03:29:00
githubexploit
githubexploit
Exploit for Unrestricted Upload of File with Dangerous Type in Wordpress
2021-05-05 16:23:03
Exploit for Path Traversal in Wordpress
2021-02-01 12:47:28
metasploit
metasploit
WordPress Crop-image Shell Upload
2019-03-22 16:37:04
cvelist
cvelist
CVE-2019-8942
2019-02-20 03:00:00
zdt
zdt
WordPress Core 5.0 - Remote Code Execution Exploit
2019-03-08 00:00:00
WordPress 5.0.0 crop-image Shell Upload Exploit
2019-04-05 00:00:00
debian
debian
[SECURITY] [DLA 1742-1] wordpress security update
2019-03-31 19:30:13
[SECURITY] [DSA 4401-1] wordpress security update
2019-03-01 07:03:31
[SECURITY] [DSA 4401-1] wordpress security update
2019-03-01 07:03:31