CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.
Explanation of Vulnerability in Simple Terms
BuddyPress XProfile Custom Image Field versions 3.0.1 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to disrupt site availability. An attacker can craft requests that cause the server to become unresponsive or crash. No user interaction is required. The vulnerability affects the entire site, not just the plugin.
What an attacker can do
Make the site unavailable by sending specially crafted requests that crash or hang the server.
Potential impact on your site
Your site may become unavailable or unresponsive without warning or user action.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
