CVE-2025-46348

CVE-2025-46348 · YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

CVSS 10.0 · Kritisch · EPSS 0,7% · Korrektur verfügbar

Veröffentlicht

2025-04-29T20:39:40.423Z

Aktualisiert

2025-04-30T13:19:35.339Z

Technologie-Stack: php

Prüfen Sie Ihren Server →