CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17.
Explanation of Vulnerability in Simple Terms
The Sendinblue for WooCommerce plugin through version 4.0.17 contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with low-level access can bypass directory restrictions and access sensitive files outside the intended plugin directory. This could expose configuration files, database credentials, or other sensitive data stored on the server.
What an attacker can do
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
Sensitive server files and credentials could be exposed to authenticated attackers, risking data breach.
Conditions required to exploit
Attacker must have a low-privilege user account on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
