CVE-2020-11738 WordPress Snap Creek Duplicator Plugin File Download
An attacker can read arbitrary files from the server via directory traversal in the Snap Creek Duplicator WordPress plugin.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11738?
CVE-2020-11738 is a high-severity path traversal vulnerability in n/a, published on 13 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.
Weakness: CWE-22
Which versions are affected by CVE-2020-11738?
It affects 1 product.
Products include Awesomemotive Duplicator.
How do I fix CVE-2020-11738?
No fix has been published for CVE-2020-11738 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-11738 being exploited?
Yes. Attackers have exploited CVE-2020-11738 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE
- CVE-2018-17207 Code injection in n/a
- CVE-2023-6114 Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
- CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
- CVE-2023-33309 WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-wfr8-hp36-c4v2.