CVE-2023-7002highCWE-78

CVE-2023-7002: fallo de gravedad alta en inisev BackupBliss – Backup & Migration with…

Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BackupBliss – Backup & Migration with Free Cloud Storage

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 31%
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
inisev · BackupBliss – Backup & Migration with Free Cloud Storage
CVEs relacionadas — inisev BackupBliss – Backup & Migration with…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6553CRITICALBackup Migration <= 1.3.7 - Unauthenticated Remote Code ExecutionEPSS 97.8%CVE-2023-6266HIGHBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information ExposureEPSS 2.1%CVE-2023-6972CRITICALBackup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File DeletionEPSS 1.4%CVE-2024-10932HIGHBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'EPSS 0.8%CVE-2023-0958MEDIUMInisev Plugins (Various Versions) - Missing Authorization on handle_installation functionEPSS 0.7%CVE-2023-3977MEDIUMInisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation functionEPSS 0.6%