Path Traversal Vulnerability Affects LWS Affiliation
CVE-2023-32297

9CRITICAL

Key Information:

Vendor

WordPress
Status
Lws Affiliation
Vendor
CVE Published:
17 May 2024

What is CVE-2023-32297?

A vulnerability exists in the LWS Affiliation plugin that permits local file inclusion through improper restriction of pathname access. This flaw can be exploited to access sensitive files on the server, leading to potential data exposure and compromise of the web application's integrity. Affected versions include all releases prior to 2.2.6, presenting a significant risk for users who have not updated to the latest version.

Affected Version(s)

LWS Affiliation <= 2.2.6

References

https://patchstack.com/database/vulnerability/lws-affilia...
vdb-entry

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Höbenreich (Patchstack Alliance)
.