Description

WordPress Plugin Vitamin is prone to multiple arbitrary file disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin Vitamin version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.1.0 or latest

References

http://secunia.com/advisories/50176/

http://www.securityfocus.com/bid/54856/

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2010-3709)

Jboss EAP Improper Input Validation Vulnerability (CVE-2011-4575)

WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.5)

Drupal Other Vulnerability (CVE-2007-4063)

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0155)

Severity

High

Classification

CVE-2012-6651 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure