Dejavu Vulnerabilities

The DejaVu Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.4. This is due to the '_mysite_download_skin' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to download any file within the server of the vulnerable service.

CVSS:

9.1

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The DejaVu Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.4. This is due to the '_mysite_delete_skin_zip' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to delete any file on the server of the vulnerable service.

CVSS:

7.5

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The DejaVu Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.4. This is due to the '_mysite_download_skin' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to download any file within the server of the vulnerable service.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The DejaVu Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.4. This is due to the '_mysite_delete_skin_zip' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to delete any file on the server of the vulnerable service.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The dejavu WordPress theme was affected by a dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download security vulnerability.

Affected:

up to 2.5

Fixed in:

2.5

The dejavu WordPress theme was affected by a dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion security vulnerability.

Affected:

up to 2.5

Fixed in:

2.5