Fix FN matcher-request
parent
e72b8e49ef
commit
1cfd71828c
|
@ -1,16 +1,17 @@
|
|||
id: CVE-2024-6366
|
||||
|
||||
info:
|
||||
name: User Profile Builder < 3.11.8 - Unauthenticated Media Upload
|
||||
name: User Profile Builder < 3.11.8 - File Upload
|
||||
author: securityforeveryone
|
||||
severity: high
|
||||
description: |
|
||||
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
|
||||
reference:
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-6366
|
||||
- https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/
|
||||
- https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-6366
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2024-6366
|
||||
classification:
|
||||
cve-id: CVE-2024-6366
|
||||
epss-score: 0.00043
|
||||
epss-percentile: 0.09351
|
||||
metadata:
|
||||
|
@ -28,15 +29,13 @@ variables:
|
|||
http:
|
||||
- raw:
|
||||
- |
|
||||
GET /wp-content/plugins/profile-builder/readme.txt HTTP/1.1
|
||||
GET / HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
matchers:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'contains(body,"User Profile Builder")'
|
||||
- 'status_code == 200'
|
||||
condition: and
|
||||
- 'contains(body,"/plugins/profile-builder")'
|
||||
internal: true
|
||||
|
||||
- raw:
|
||||
|
|
Loading…
Reference in New Issue