CVE-2024-13365

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13365
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives when scanning them for malware through the checkUploadedArchive() function in all versions up to, and including, 2.149. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS

No CVSS.

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3229205/security-malware-firewall#file527 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa30fa2-6c42-4e5f-a0b5-8711ce5d8121?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cleantalk:security_\&_malware_scan:*:*:*:*:*:wordpress:*:*
History

25 Feb 2025, 18:27

Type Values Removed Values Added
CPE cpe:2.3:a:cleantalk:security_\&_malware_scan:*:*:*:*:*:wordpress:*:*
First Time Cleantalk security \& Malware Scan
Cleantalk
References () https://plugins.trac.wordpress.org/changeset/3229205/security-malware-firewall#file527 - () https://plugins.trac.wordpress.org/changeset/3229205/security-malware-firewall#file527 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa30fa2-6c42-4e5f-a0b5-8711ce5d8121?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa30fa2-6c42-4e5f-a0b5-8711ce5d8121?source=cve - Third Party Advisory

12 Feb 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : unknown

12 Feb 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-12 10:15

Updated : 2025-02-25 18:27

NVD link : CVE-2024-13365

Mitre link : CVE-2024-13365

JSON object : View

Products Affected

cleantalk

  • security_\&_malware_scan
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type