CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3813 – Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download
https://notcve.org/view.php?id=CVE-2023-3813
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. El plugin Jupiter X Core para WordPress es vulnerable a la descarga de archivos arbitrarios en versiones hasta la 2.5.0 inclusive. Esto hace posible que atacantes no autenticados descarguen el contenido de archivos arbitrarios en el servidor, que pueden contener información sensible. • https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425 https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 1CVE-2022-1654 – Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation
https://notcve.org/view.php?id=CVE-2022-1654
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions Jupiter Theme versiones anteriores a 6.10.1 incluyéndola y JupiterX Core Plugin versiones anteriores a 2.0.7 incluyéndola, permiten que cualquier atacante autenticado, incluyendo un atacante a nivel de suscriptor o cliente, obtenga privilegios administrativos por medio de las acciones AJAX "abb_uninstall_template" (ambas) y "jupiterx_core_cp_uninstall_template" (sólo JupiterX Core) • https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-1657 – JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion
https://notcve.org/view.php?id=CVE-2022-1657
Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function. Las versiones vulnerables de los Temas Jupiter (versiones anteriores a 6.10.1 incluyéndolas) y JupiterX (versiones anteriores a 2.0.6 incluyéndola) permiten a usuarios con sesión iniciada, incluidos los de nivel de suscriptor, llevar a cabo un Salto de Ruta y una inclusión de Archivos Locales. • https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1658 – Jupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin Deletion
https://notcve.org/view.php?id=CVE-2022-1658
Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site. Las versiones vulnerables de Jupiter Theme (versiones anteriores a 6.10.1 incluyéndola) permiten la eliminación arbitraria de plugins por parte de cualquier usuario autenticado, incluidos los usuarios con el rol de suscriptor, por medio de la acción AJAX abb_remove_plugin registrada en el archivo framework/admin/control-panel/logic/plugin-management.php. usando esta funcionalidad, cualquier usuario conectado puede eliminar cualquier plugin instalado en el sitio Vulnerable versions of the Jupiter Theme allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site. • https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1659 – JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of Service
https://notcve.org/view.php?id=CVE-2022-1659
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack. Las versiones vulnerables del plugin JupiterX Core (versiones anteriores a 2.0.6 incluyéndola) registran una acción AJAX jupiterx_conditional_manager que puede ser usada para llamar a cualquier función en el archivo includes/condition/class-condition-manager.php mediante el envío de la función deseada a llamar en el parámetro sub_action. Esto puede usarse para visualizar la configuración del sitio y los usuarios registrados, modificar las condiciones de publicación o llevar a cabo un ataque de denegación de servicio Vulnerable versions of the JupiterX Core plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack. • https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes • CWE-284: Improper Access Control •