All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download

2020-01-20 00:00
Kamil Vavra

Strategic Overview

Status
Patched in 7.15
Affected Plugin
All-in-One WP Migration and Backup
Affected Version
< 7.15
CVSS
5.9Medium
Weakness type
CWE-330 · Use of Insufficiently Random Values
CVE
CVE pending
View all All-in-One WP Migration and Backup vulnerabilities

At a glance

This record tracks a medium-severity Use of Insufficiently Random Values vulnerability in the All-in-One WP Migration and Backup WordPress plugin, affecting versions < 7.15. It carries a CVSS score of 5.9 (reachable over the network; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 7.15; sites on affected versions should update now. Disclosed January 2020, reported by Kamil Vavra.

Vulnerability Overview

The All-in-One WP Migration plugin for WordPress is vulnerable to unauthenticated arbitrary back-up downloads due to insufficient filename randomization that made it possible for unauthenticated attackers to brute force back-up filenames in unique situations in versions up to, and including, 7.14. This would make it possible for unauthenticated attackers to discover information from files contained in the back-ups that could be used to aid further attacks or lead to simply sensitive information disclosure.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-330: Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Remediation

Update to version 7.15, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: All-in-One WP Migration and Backup 7.15 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/f373a1d5-3d7e-4a0a-af03-28ca6ce6a170

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C