The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
{
"cna_assigner": "WPScan",
"unresolved_ranges": [
{
"extracted_events": [
{
"introduced": "1.9"
},
{
"fixed": "2.0.9"
},
{
"introduced": "2.1"
},
{
"fixed": "2.1.7"
},
{
"introduced": "2.2"
},
{
"fixed": "2.2.10"
},
{
"introduced": "2.3"
},
{
"fixed": "2.3.10"
},
{
"introduced": "2.4"
},
{
"fixed": "2.4.7"
},
{
"introduced": "2.5"
},
{
"fixed": "2.5.5"
},
{
"introduced": "2.6"
},
{
"fixed": "2.6.6"
},
{
"introduced": "2.7"
},
{
"fixed": "2.7.5"
},
{
"introduced": "2.8"
},
{
"fixed": "2.8.5"
},
{
"introduced": "2.9"
},
{
"fixed": "2.9.6"
},
{
"introduced": "3.0"
},
{
"fixed": "3.0.6"
},
{
"introduced": "3.1"
},
{
"fixed": "3.1.5"
},
{
"introduced": "3.2"
},
{
"fixed": "3.2.5"
},
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
},
{
"introduced": "3.4"
},
{
"fixed": "3.4.6"
},
{
"introduced": "3.5"
},
{
"fixed": "3.5.6"
},
{
"introduced": "3.6"
},
{
"fixed": "3.6.4"
},
{
"introduced": "3.7"
},
{
"fixed": "3.7.5"
},
{
"introduced": "3.8"
},
{
"fixed": "3.8.5"
},
{
"introduced": "3.9"
},
{
"fixed": "3.9.9"
},
{
"introduced": "4.0"
},
{
"fixed": "4.0.6"
},
{
"introduced": "4.1"
},
{
"fixed": "4.1.3"
},
{
"introduced": "4.2"
},
{
"fixed": "4.2.4"
},
{
"introduced": "4.3"
},
{
"fixed": "4.3.4"
},
{
"introduced": "4.4"
},
{
"fixed": "4.4.4"
},
{
"introduced": "4.5"
},
{
"fixed": "4.5.2"
},
{
"introduced": "4.6"
},
{
"fixed": "4.6.2"
},
{
"introduced": "4.7"
},
{
"fixed": "4.7.3"
},
{
"introduced": "4.8"
},
{
"fixed": "4.8.4"
},
{
"introduced": "4.9"
},
{
"fixed": "4.9.2"
},
{
"introduced": "5.0"
},
{
"fixed": "5.0.2"
},
{
"introduced": "5.1"
},
{
"fixed": "5.1.3"
},
{
"introduced": "5.2"
},
{
"fixed": "5.2.4"
},
{
"introduced": "5.3"
},
{
"fixed": "5.3.3"
},
{
"introduced": "5.4"
},
{
"fixed": "5.4.3"
},
{
"introduced": "5.5"
},
{
"fixed": "5.5.4"
},
{
"introduced": "5.6"
},
{
"fixed": "5.6.4"
},
{
"introduced": "5.7"
},
{
"fixed": "5.7.4"
},
{
"introduced": "5.8"
},
{
"fixed": "5.8.3"
},
{
"introduced": "5.9"
},
{
"fixed": "5.9.3"
},
{
"introduced": "6.0"
},
{
"fixed": "6.0.3"
},
{
"introduced": "6.1"
},
{
"fixed": "6.1.4"
},
{
"introduced": "6.2"
},
{
"fixed": "6.2.4"
},
{
"introduced": "6.3"
},
{
"fixed": "6.3.6"
},
{
"introduced": "6.4"
},
{
"fixed": "6.4.5"
},
{
"introduced": "6.5"
},
{
"fixed": "6.5.3"
},
{
"introduced": "6.6"
},
{
"fixed": "6.6.4"
},
{
"introduced": "6.7"
},
{
"fixed": "6.7.3"
},
{
"introduced": "6.8"
},
{
"fixed": "6.8.4"
},
{
"introduced": "6.9"
},
{
"fixed": "6.9.3"
},
{
"introduced": "7.0"
},
{
"fixed": "7.0.4"
},
{
"introduced": "7.1"
},
{
"fixed": "7.1.4"
},
{
"introduced": "7.2"
},
{
"fixed": "7.2.4"
},
{
"introduced": "7.3"
},
{
"fixed": "7.3.4"
},
{
"introduced": "7.4"
},
{
"fixed": "7.4.4"
},
{
"introduced": "7.5"
},
{
"fixed": "7.5.6"
},
{
"introduced": "7.6"
},
{
"fixed": "7.6.3"
},
{
"introduced": "7.7"
},
{
"fixed": "7.7.5"
},
{
"introduced": "7.8"
},
{
"fixed": "7.8.3"
},
{
"introduced": "7.9"
},
{
"fixed": "7.9.3"
},
{
"introduced": "8.0"
},
{
"fixed": "8.0.2"
},
{
"introduced": "8.1"
},
{
"fixed": "8.1.3"
},
{
"introduced": "8.2"
},
{
"fixed": "8.2.5"
},
{
"introduced": "8.3"
},
{
"fixed": "8.3.2"
},
{
"introduced": "8.4"
},
{
"fixed": "8.4.4"
},
{
"introduced": "8.5"
},
{
"fixed": "8.5.2"
},
{
"introduced": "8.6"
},
{
"fixed": "8.6.3"
},
{
"introduced": "8.7"
},
{
"fixed": "8.7.3"
},
{
"introduced": "8.8"
},
{
"fixed": "8.8.4"
},
{
"introduced": "8.9"
},
{
"fixed": "8.9.3"
},
{
"introduced": "9.0"
},
{
"fixed": "9.0.4"
},
{
"introduced": "9.1"
},
{
"fixed": "9.1.2"
},
{
"introduced": "9.2"
},
{
"fixed": "9.2.3"
},
{
"introduced": "9.3"
},
{
"fixed": "9.3.4"
},
{
"introduced": "9.4"
},
{
"fixed": "9.4.3"
},
{
"introduced": "9.5"
},
{
"fixed": "9.5.4"
},
{
"introduced": "9.6"
},
{
"fixed": "9.6.3"
},
{
"introduced": "9.7"
},
{
"fixed": "9.7.2"
},
{
"introduced": "9.8"
},
{
"fixed": "9.8.2"
},
{
"introduced": "9.9"
},
{
"fixed": "9.9.2"
},
{
"introduced": "10.0"
},
{
"fixed": "10.0.1"
},
{
"introduced": "10.1"
},
{
"fixed": "10.1.1"
},
{
"introduced": "10.2"
},
{
"fixed": "10.2.2"
},
{
"introduced": "10.3"
},
{
"fixed": "10.3.1"
},
{
"introduced": "10.4"
},
{
"fixed": "10.4.1"
},
{
"introduced": "10.5"
},
{
"fixed": "10.5.2"
},
{
"introduced": "10.6"
},
{
"fixed": "10.6.2"
},
{
"introduced": "10.7"
},
{
"fixed": "10.7.1"
},
{
"introduced": "10.8"
},
{
"fixed": "10.8.1"
},
{
"introduced": "10.9"
},
{
"fixed": "10.9.2"
},
{
"introduced": "11.0"
},
{
"fixed": "11.0.1"
},
{
"introduced": "11.1"
},
{
"fixed": "11.1.3"
},
{
"introduced": "11.2"
},
{
"fixed": "11.2.1"
},
{
"introduced": "11.3"
},
{
"fixed": "11.3.3"
},
{
"introduced": "11.4"
},
{
"fixed": "11.4.1"
},
{
"introduced": "11.5"
},
{
"fixed": "11.5.2"
},
{
"introduced": "11.6"
},
{
"fixed": "11.6.1"
},
{
"introduced": "11.7"
},
{
"fixed": "11.7.2"
},
{
"introduced": "11.8"
},
{
"fixed": "11.8.5"
},
{
"introduced": "11.9"
},
{
"fixed": "11.9.2"
},
{
"introduced": "12.0"
},
{
"fixed": "12.0.1"
},
{
"introduced": "12.1"
},
{
"fixed": "12.1.1"
}
],
"source": "AFFECTED_FIELD"
},
{
"extracted_events": [
{
"fixed": "12.1.1"
}
],
"source": "DESCRIPTION"
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2996.json"
}{
"cpe": "cpe:2.3:a:automattic:jetpack:*:*:*:*:*:wordpress:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "12.1.1"
}
]
}