CVE-2014-9734

Currently unrated

Key Information:

Vendor
Wordpress
Status
Slider Revolution
Vendor
CVE Published:
30 June 2015

Summary

Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

References

http://www.exploit-db.com/exploits/34511
exploitx_refsource_EXPLOIT-DB
http://marketblog.envato.com/news/affected-themes/
x_refsource_MISC
https://blog.sucuri.net/2014/09/slider-revolution-plugin-...
x_refsource_CONFIRM

EPSS Score

45% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.