Description

WordPress Plugin BackupBuddy is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin BackupBuddy version 2.2.28 is vulnerable; other versions may also be affected.

Remediation

Make sure that the file 'importbuddy.php' is removed from the root of the website

References

http://packetstormsecurity.com/files/120923/Backupbuddy-2.2.4-Sensitive-Data-Exposure.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html

Related Vulnerabilities

Opencart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-29470)

Internet Information Services Other Vulnerability (CVE-2000-0024)

Oracle Database Server CVE-2011-0835 Vulnerability (CVE-2011-0835)

WordPress Plugin Cool Video Gallery Command Injection (1.9)

Apache HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2014-0118)

Severity

High

Classification

CVE-2013-2743 CVE-2013-2744 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure