CVE-2018-19456 Information disclosure in n/a
Remote attackers can obtain sensitive information from server folders and files via the WP Backup+ plugin for WordPress.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-19456?
CVE-2018-19456 is a high-severity vulnerability in Opensuse Leap, published on 7 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
Weakness: CWE-200
Which versions are affected by CVE-2018-19456?
It affects 2 products.
Linux distribution packages (4)
libgit2 SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 0.24.1-7.9.1 |
libgit2 SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 0.24.1-7.9.1 |
libgit2 SUSE:Manager Server 3.1 | All versions | 0.24.1-7.9.1 |
libgit2 SUSE:Manager Server 3.2 | All versions | 0.24.1-7.9.1 |
Products include Opensuse Leap, Wplaunchpad Wpbackupplus.
How do I fix CVE-2018-19456?
Apply the vendor's patch.
Is CVE-2018-19456 being exploited?
There is no known exploitation of CVE-2018-19456 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as GHSA-gfq3-c4vg-p6gr, SUSE-SU-2019:0024-1.