What is the CVSS score of CVE-2014-5460?

CVE-2014-5460 has a CVSS 2.0 base score of 6.5 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. EPSS exploitation probability: 64.7%.

Is there a public PoC exploit available for CVE-2014-5460?

Yes, a public proof-of-concept exploit is available for CVE-2014-5460. Prioritise patching immediately. EPSS: 64.7%.

Is there a patch available for CVE-2014-5460?

Yes, a patch is available for CVE-2014-5460. Update the affected software to the latest version immediately.

PHP CVE-2014-5460

MEDIUM

Improper Input Validation (CWE-20)

2014-09-11 cve@mitre.org

RCE WordPress PHP File Upload Tibulant Slideshow Gallery

6.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 11, 2014 - 15:55 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.

AnalysisAI

Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.

Technical ContextAI

This vulnerability is classified under CWE-20. Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/. Affected products include: Tribulant Tibulant Slideshow Gallery. Version information: before 1.4.7.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.