CVE-2012-4920 Forums < 1.4.4 - Directory Traversal
MediumCVSS 5.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the zing_forum_output function in forum.php in the Zingiri Forum (aka Forums) plugin before 1.4.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zingiri forums | <= 1.4.3 | No fix listed |
| zingiri forums | = 1.0.0 | No fix listed |
| zingiri forums | = 1.0.1 | No fix listed |
| zingiri forums | = 1.0.2 | No fix listed |
| zingiri forums | = 1.0.3 | No fix listed |
| zingiri forums | = 1.0.4 | No fix listed |
| zingiri forums | = 1.0.5 | No fix listed |
| zingiri forums | = 1.0.6 | No fix listed |
| zingiri forums | = 1.0.7 | No fix listed |
| zingiri forums | = 1.0.8 | No fix listed |
| zingiri forums | = 1.0.9 | No fix listed |
| zingiri forums | = 1.1.0 | No fix listed |
| zingiri forums | = 1.1.1 | No fix listed |
| zingiri forums | = 1.2.0 | No fix listed |
| zingiri forums | = 1.2.1 | No fix listed |
| zingiri forums | = 1.3.0 | No fix listed |
| zingiri forums | = 1.3.1 | No fix listed |
| zingiri forums | = 1.4.0 | No fix listed |
| zingiri forums | = 1.4.1 | No fix listed |
| zingiri forums | = 1.4.2 | No fix listed |
| wordpress zingiri-forum(WordPress) | < 1.4.4 | 1.4.4 |
References
- 89069 vdb-entry
- 50833 third-party-advisory vendor-advisory
- wordpress.org patch vendor-advisory
- wp-zingiriforum-url-directory-traversal(81156) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org