We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-7627

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition



AssignerWordfence
Reserved2024-08-08
Published2024-09-05
Updated2024-09-05

Description

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.



HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Default status
0x4000603660

6.0
affected

Timeline

2024-09-04:Disclosed

Credits

TANG Cheuk Hei 0x40006036b0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29de7a-3f15-4b6d-aad7-6a08151e2113?source=cve

https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L39

https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L88

https://plugins.trac.wordpress.org/changeset/3138710/

cve.org CVE-2024-7627

nvd.nist.gov CVE-2024-7627

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-7627
Subscribe to our newsletter to learn more about our work.