Vulnerability · Published Dec 10, 2024 · Assigned by WPScan

CVE-2024-10708System Dashboard < 2.8.15 - Admin+ Path Traversal

Medium 4.9

In plain English

A medium-severity security flaw in System Dashboard from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)2.0%top 18.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server

Affected products (as reported)

Vendor	Product	Versions
Unknown	System Dashboard	0 – before 2.8.15

References

https://wpscan.com/vulnerability/61d750a5-8c2c-4c94-a1a9-6a254c2a0d03/ exploit, vdb-entry, technical-description