CVE-2024-8352
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress contains a Directory Traversal vulnerability in all versions up to and including 4.1.11. This vulnerability is present in the download_log function and allows unauthenticated attackers to read the contents of arbitrary files on the server.
Impact
This vulnerability enables unauthenticated attackers to access and read arbitrary files on the server, potentially exposing sensitive information. The CVSS v3.1 base score is 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates a high confidentiality impact, with no impact on integrity or availability. The attack vector is network-based, requires low complexity, no privileges, and no user interaction.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in version 4.1.12 of the Social Web Suite plugin. The patch was added on October 8, 2024, and can be found at the WordPress plugin repository.
Mitigation
1. Update the Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin to version 4.1.12 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the plugin until the update can be applied. 3. Implement strong access controls and input validation mechanisms to prevent unauthorized access to sensitive files. 4. Regularly audit and monitor server logs for any suspicious file access attempts. 5. Apply the principle of least privilege to all WordPress installations and associated plugins.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Timeline
Feedly found the first article mentioning CVE-2024-8352. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-8352
A CVSS base score of 7.5 has been assigned.
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.06% (Percentile: 28.9%)