FKIE_CVE-2024-5348

Vulnerability from fkie_nvd - Published: 2024-06-01 09:15 - Updated: 2024-11-21 09:47
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' attribute of the beforeafter widget, the 'eventsgrid_layout' attribute of the eventsgrid and list widgets, the 'marquee_layout' attribute of the marquee widget, the 'postgrid_layout' attribute of the postgrid widget, the 'woocart_layout' attribute of the woocart widget, and the 'woogrid_layout' attribute of the woogrid widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
References
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/beforeafter/index.php#L121
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/eventsgrid/index.php#L113
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/list/index.php#L401
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/marquee/index.php#L200
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/postgrid/index.php#L186
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset/3094318/
security@wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/e55b86e2-b42e-483d-93cd-2f09af64dbc7?source=cve
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/beforeafter/index.php#L121
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/eventsgrid/index.php#L113
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/list/index.php#L401
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/marquee/index.php#L200
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/postgrid/index.php#L186
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/changeset/3094318/
af854a3a-2127-422b-91ae-364da2661108https://www.wordfence.com/threat-intel/vulnerabilities/id/e55b86e2-b42e-483d-93cd-2f09af64dbc7?source=cve
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the \u0027beforeafter_layout\u0027 attribute of the beforeafter widget, the \u0027eventsgrid_layout\u0027 attribute of the eventsgrid and list widgets, the \u0027marquee_layout\u0027 attribute of the marquee widget, the \u0027postgrid_layout\u0027 attribute of the postgrid widget, the \u0027woocart_layout\u0027  attribute of the woocart widget, and the \u0027woogrid_layout\u0027 attribute of the woogrid widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
    },
    {
      "lang": "es",
      "value": "El complemento Elements For Elementor para WordPress es vulnerable a la inclusi\u00f3n de archivos locales en todas las versiones hasta la 2.1 incluida a trav\u00e9s del atributo \u0027beforeafter_layout\u0027 del widget beforeafter, el atributo \u0027eventsgrid_layout\u0027 de los widgets de lista y grid de eventos, el \u0027marquee_layout\u0027 atributo del widget de marquesina, el atributo \u0027postgrid_layout\u0027 del widget postgrid, el atributo \u0027woocart_layout\u0027 del widget woocart y el atributo \u0027woogrid_layout\u0027 del widget woogrid. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, incluyan y ejecuten archivos arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos archivos. Esto se puede utilizar para eludir los controles de acceso, obtener datos confidenciales o lograr la ejecuci\u00f3n de c\u00f3digo en los casos en que se puedan cargar e incluir im\u00e1genes y otros tipos de archivos \"seguros\"."
    }
  ],
  "id": "CVE-2024-5348",
  "lastModified": "2024-11-21T09:47:28.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-06-01T09:15:10.063",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/beforeafter/index.php#L121"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/eventsgrid/index.php#L113"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/list/index.php#L401"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/marquee/index.php#L200"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/postgrid/index.php#L186"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/changeset/3094318/"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e55b86e2-b42e-483d-93cd-2f09af64dbc7?source=cve"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/beforeafter/index.php#L121"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/eventsgrid/index.php#L113"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/list/index.php#L401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/marquee/index.php#L200"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/browser/nd-elements/trunk/widgets/postgrid/index.php#L186"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://plugins.trac.wordpress.org/changeset/3094318/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e55b86e2-b42e-483d-93cd-2f09af64dbc7?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.