CVE-2024-8852mediumexploração observadaCWE-200

CVE-2024-8852: falha de média gravidade em servmask All-in-One WP Migration and Backup

All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar All-in-One WP Migration and Backup

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 5.3epss 1.2%
da publicação à arma
Publicada no NVD22 de out.
VulnCheck+402d
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
servmask · All-in-One WP Migration and Backup
CVEs relacionadas — servmask All-in-One WP Migration and Backup

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1476MEDIUMAll-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows HostsEPSS 46.3%CVE-2024-9162HIGHAll-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code InjectionEPSS 2.7%CVE-2026-19949HIGHAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionEPSS 1.0%CVE-2024-10942HIGHAll in One WP Migration <= 7.89 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.5%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%