CVE-2024-1165

Brizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal

2024-02-23 00:00
wesley (wcraft)

Strategic Overview

Status
Patched in 2.4.41
Affected Plugin
Brizy – Page Builder
Affected Version
<= 2.4.40
CVSS
4.3Medium
Weakness type
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE
CVE-2024-1165
View all Brizy – Page Builder vulnerabilities

At a glance

CVE-2024-1165 is a medium-severity Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Brizy WordPress plugin, affecting versions <= 2.4.40. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Contributor level or above. The issue is fixed in version 2.4.41; sites on affected versions should update now. Disclosed February 2024, reported by wesley (wcraft).

Vulnerability Overview

The Brizy – Page Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.39 via the 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files to arbitrary locations on the server

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Reaching this weakness in Brizy <= 2.4.40 takes an account at Contributor level or above. Path traversal happens when user-controlled text is used to build a filesystem path without being constrained to an intended directory, so sequences like ../ walk the resolved path somewhere else.

Depending on the operation, it means reading files outside the intended folder — wp-config.php being the usual target — or writing to and deleting paths the web server can touch. For Brizy the fix is 2.4.41: builds <= 2.4.40 are affected, anything from 2.4.41 onward is not.

Remediation

Update to version 2.4.41, or a newer patched version

How does WordSec protect against this?

An attacker needs Contributor access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Brizy 2.4.41 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2024-1165https://www.wordfence.com/threat-intel/vulnerabilities/id/7673b2ba-5d7a-4ae9-92e7-1a910687fdb8https://nvd.nist.gov/vuln/detail/CVE-2024-1165

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C