CVE-2023-5504 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

What is CVE-2023-5504?

CVE-2023-5504 is a high-severity path traversal vulnerability in wp_media BackWPup – WordPress Backup & Restore Plugin, published on 11 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.

Weakness: CWE-22

Which versions are affected by CVE-2023-5504?

It affects 1 product.

Products include Inpsyde Backwpup.

How do I fix CVE-2023-5504?

No fix has been published for CVE-2023-5504 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-5504 being exploited?

There is no known exploitation of CVE-2023-5504 in the wild and no public exploit code.

Other vulnerabilities in wp_media BackWPup – WordPress Backup & Restore Plugin

• CVE-2023-7164 BackWPup < 4.0.4 - Unauthenticated Backup Download High 7.5
• CVE-2017-2551 Information disclosure in backwpup High 7.5
• CVE-2023-5505 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal Medium 6.8
• CVE-2023-5775 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password Low 2.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mh4j-2c4w-jxfr.