Search criteria
6 vulnerabilities found for Database Backup and check Tables Automated With Scheduler 2024 by sminozzi
CVE-2024-13910 (GCVE-0-2024-13910)
Vulnerability from nvd – Published: 2025-03-01 08:23 – Updated: 2025-03-03 20:56
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36.
Severity ?
7.2 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.36
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:54:11.887653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:16.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.36",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the \u0027database_backup_ajax_delete\u0027 function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-01T08:23:21.649Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c92776c4-643c-40f2-ac28-5df5d6bf7fcd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/database-backup.php#L267"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3247917/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3248708/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13910",
"datePublished": "2025-03-01T08:23:21.649Z",
"dateReserved": "2025-02-25T16:21:05.622Z",
"dateUpdated": "2025-03-03T20:56:16.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13911 (GCVE-0-2024-13911)
Vulnerability from nvd – Published: 2025-03-01 07:24 – Updated: 2025-03-03 20:56
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
Severity ?
7.2 (High)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.35
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:54:14.585804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:40.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.35",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-01T07:24:05.517Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3247917/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13911",
"datePublished": "2025-03-01T07:24:05.517Z",
"dateReserved": "2025-02-25T16:33:57.671Z",
"dateUpdated": "2025-03-03T20:56:40.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12850 (GCVE-0-2024-12850)
Vulnerability from nvd – Published: 2024-12-24 09:21 – Updated: 2024-12-24 15:10
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity ?
4.9 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.32
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T15:10:07.200940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T15:10:15.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.32",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T09:21:50.959Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b972626c-6374-4084-a0e1-1ea4a3062228?source=cve"
},
{
"url": "http://plugins.svn.wordpress.org/database-backup/tags/2.32/functions/download.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3212315/database-backup/trunk/functions/download.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-23T21:07:32.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.32 - Authenticated (Admin+) Arbitrary File Read"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-12850",
"datePublished": "2024-12-24T09:21:50.959Z",
"dateReserved": "2024-12-20T15:24:56.523Z",
"dateUpdated": "2024-12-24T15:10:15.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13910 (GCVE-0-2024-13910)
Vulnerability from cvelistv5 – Published: 2025-03-01 08:23 – Updated: 2025-03-03 20:56
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36.
Severity ?
7.2 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.36
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:54:11.887653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:16.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.36",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the \u0027database_backup_ajax_delete\u0027 function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-01T08:23:21.649Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c92776c4-643c-40f2-ac28-5df5d6bf7fcd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/database-backup.php#L267"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3247917/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3248708/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13910",
"datePublished": "2025-03-01T08:23:21.649Z",
"dateReserved": "2025-02-25T16:21:05.622Z",
"dateUpdated": "2025-03-03T20:56:16.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13911 (GCVE-0-2024-13911)
Vulnerability from cvelistv5 – Published: 2025-03-01 07:24 – Updated: 2025-03-03 20:56
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.
Severity ?
7.2 (High)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.35
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T20:54:14.585804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T20:56:40.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.35",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-01T07:24:05.517Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3247917/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-28T00:00:00.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13911",
"datePublished": "2025-03-01T07:24:05.517Z",
"dateReserved": "2025-02-25T16:33:57.671Z",
"dateUpdated": "2025-03-03T20:56:40.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12850 (GCVE-0-2024-12850)
Vulnerability from cvelistv5 – Published: 2024-12-24 09:21 – Updated: 2024-12-24 15:10
VLAI?
Title
Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read
Summary
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity ?
4.9 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| sminozzi | Database Backup and check Tables Automated With Scheduler 2024 |
Affected:
* , ≤ 2.32
(semver)
|
Credits
Dzmitry Sviatlichny
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T15:10:07.200940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T15:10:15.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Database Backup and check Tables Automated With Scheduler 2024",
"vendor": "sminozzi",
"versions": [
{
"lessThanOrEqual": "2.32",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dzmitry Sviatlichny"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T09:21:50.959Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b972626c-6374-4084-a0e1-1ea4a3062228?source=cve"
},
{
"url": "http://plugins.svn.wordpress.org/database-backup/tags/2.32/functions/download.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3212315/database-backup/trunk/functions/download.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-23T21:07:32.000+00:00",
"value": "Disclosed"
}
],
"title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.32 - Authenticated (Admin+) Arbitrary File Read"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-12850",
"datePublished": "2024-12-24T09:21:50.959Z",
"dateReserved": "2024-12-20T15:24:56.523Z",
"dateUpdated": "2024-12-24T15:10:15.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}