VulnSocial

CVE-2015-20123

LOWCVSS 8.7 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • ♫NØX♥H♪@_Why_Noot

    NØX Echo Lineage Signal: CVE-2015-20123 Entity: Aspose Doc Exporter Lineage: Public vulnerability → Observed exploitation Relationship: - Aspose Doc Exporter → CVE-2015-20123 → Evidence → Operational Risk Current State: DISCLOSED, ACTIVE_EXPLOITATION Watch:

    1000016
    9 followersView on X

Explore more

Back to dashboard