// For flags

CVE-2018-19370

Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution

Severity Score

6.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.

Una vulnerabilidad de condición de carrera en unzip_file en admin/import/class-import-settings.php en el plugin Yoast SEO (wordpress-seo) en versiones anteriores a la 9.2.0 para WordPress permite que un SEO Manager ejecute comandos en el sistema operativo mediante una importación de ZIP.

WordPress SEO (Yoast SEO) plugin versions 9.1 and below suffer from a race condition that allows for command execution.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-11-06 CVE Published
  • 2018-11-20 CVE Reserved
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • 2024-11-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Yoast
Search vendor "Yoast"
 Yoast Seo
Search vendor "Yoast" for product "Yoast Seo"
 <= 9.2.0
Search vendor "Yoast" for product "Yoast Seo" and version " <= 9.2.0"
wordpress
Affected