CVEvulnerability
CVE-2019-1010209
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-434
Description
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
Affected configurations
• gorul gourl (<= 1.4.13)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af Patch, Third Party Advisory
- https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637 Patch, Third Party Advisory
- https://www.youtube.com/watch?v=K2HElM_ZYu4 Exploit, Third Party Advisory
- https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af Patch, Third Party Advisory
- https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637 Patch, Third Party Advisory
- https://www.youtube.com/watch?v=K2HElM_ZYu4 Exploit, Third Party Advisory