CVE-2012-4920 : Directory traversal vulnerability in the zing_forum

Directory traversal vulnerability in the zing_forum_output function in forum.php in the Zingiri Forum (aka Forums) plugin before 1.4.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter to index.php.

Published 2014-04-04 14:55:05

Updated 2025-04-12 10:46:41

Source Flexera Software LLC

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2012-4920

Zingiri » Forums
Versions up to, including, (<=) 1.4.3
cpe:2.3:a:zingiri:forums:*:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.3
cpe:2.3:a:zingiri:forums:1.0.3:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.4
cpe:2.3:a:zingiri:forums:1.0.4:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.1.1
cpe:2.3:a:zingiri:forums:1.1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.2.0
cpe:2.3:a:zingiri:forums:1.2.0:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.1
cpe:2.3:a:zingiri:forums:1.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.2
cpe:2.3:a:zingiri:forums:1.0.2:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.9
cpe:2.3:a:zingiri:forums:1.0.9:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.1.0
cpe:2.3:a:zingiri:forums:1.1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.4.1
cpe:2.3:a:zingiri:forums:1.4.1:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.4.2
cpe:2.3:a:zingiri:forums:1.4.2:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.0
cpe:2.3:a:zingiri:forums:1.0.0:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.7
cpe:2.3:a:zingiri:forums:1.0.7:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.8
cpe:2.3:a:zingiri:forums:1.0.8:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.3.1
cpe:2.3:a:zingiri:forums:1.3.1:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.4.0
cpe:2.3:a:zingiri:forums:1.4.0:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.5
cpe:2.3:a:zingiri:forums:1.0.5:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.0.6
cpe:2.3:a:zingiri:forums:1.0.6:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.2.1
cpe:2.3:a:zingiri:forums:1.2.1:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A
Zingiri » Forums » Version: 1.3.0
cpe:2.3:a:zingiri:forums:1.3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Wordpress » Wordpress » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2012-4920

EPSS FAQ

1.72%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-4920

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2012-4920

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-4920

http://osvdb.org/89069
http://secunia.com/advisories/50833

Sign in
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/81156

Zingiri Forum plugin for WordPress url parameter directory traversal CVE-2012-4920 Vulnerability Report
http://wordpress.org/plugins/zingiri-forum/changelog

Forums – WordPress plugin | WordPress.org
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2012-4920

Products affected by CVE-2012-4920

Exploit prediction scoring system (EPSS) score for CVE-2012-4920

CVSS scores for CVE-2012-4920

CWE ids for CVE-2012-4920

References for CVE-2012-4920