CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Astra Security Suite versions 0.2 and earlier contain an improper access control vulnerability that allows unauthenticated attackers to read and modify sensitive data on affected sites. The vulnerability requires specific network conditions to exploit but does not require user interaction. Successful exploitation can compromise site confidentiality, integrity, and availability.
What an attacker can do
Read and modify sensitive site data without authentication.
Potential impact on your site
Attackers can access and alter site data, user information, and security settings without a password.
Conditions required to exploit
Network access to the affected site; specific network conditions required (high attack complexity).
Key dates
External resources
Related vulnerabilities
