1. Home
  2. CVE Database
  3. CVE-2023-0156
MEDIUM · 4.9

CVE-2023-0156

The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary fil...

Vulnerability Description

The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
UpdraftplusAll-In-One Security< 5.1.5

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2023-0156?

CVE-2023-0156 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary fil...

How severe is CVE-2023-0156?

CVE-2023-0156 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-0156?

Check the references section above for vendor advisories and patch information. Affected products include: Updraftplus All-In-One Security.