Path Traversal in String Locator Project
CVE-2022-0493
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- String_locator_project String_locator
- Unknown String Locator — versions 2.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, Third Party Advisory, x_refsource_MISC)
- contact@wpscan.com (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-0493?
- CVE-2022-0493 is a medium-severity vulnerability in String Locator Project, classified under Path Traversal. CVSS score: 4.9/10. Published 2022-03-28.
- How severe is CVE-2022-0493?
- Medium severity. CVSS v3 base score is 4.9 out of 10.
- Is CVE-2022-0493 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.