CVE-2021-25020CWE-22
CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal
published January 3, 2022
What it is
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.01021 · 63.1th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2022-01-03T12:49Z
EPSS history
Timeline