CVE-2013-2741 - importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request

Back Back to CVE browser

HIGH

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request

Published Apr 2, 2013

7.5

HIGH

CVSS 2.0

EPSS 2.56%

Description

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html
mailing-listx_refsource_FULLDISCExploit
http://packetstormsecurity.com/files/120923
x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2680
Advisory

Link	Providers	Tags
http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html		mailing-listx_refsource_FULLDISCExploit
http://packetstormsecurity.com/files/120923		x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-2680		Advisory