Vulnerabilities > CVE-2022-4236 - Files or Directories Accessible to External Parties vulnerability in Collne Welcart E-Commerce

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
collne
CWE-552

Summary

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.

Vulnerable Configurations

Part Description Count
Application
Collne
206