{"id":103386,"date":"2022-02-19T09:36:57","date_gmt":"2022-02-19T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok"},"modified":"2022-02-19T09:36:57","modified_gmt":"2022-02-19T07:36:57","slug":"utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","title":{"rendered":"WordPressi plugina UpdraftPlus andmebaasi lekkimine, millel on 3 miljonit installi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule on ka k\u00f5igi kasutajate parameetrid ja paroolide r\u00e4si. Probleem on lahendatud versioonides 1.22.3 ja 2.22.3, mille paigaldamist soovitatakse k\u00f5igile UpdraftPlus kasutajatele niipea kui v\u00f5imalik. <\/p>\n

UpdraftPlus esitleb ennast kui k\u00f5ige populaarsemat lisandmoodulit veebisaitide varundamiseks, mis toimivad WordPress'i platvormil. Vale juurdep\u00e4\u00e4su kontrollimise t\u00f5ttu v\u00f5imaldas lisa laadida mitte ainult administraatoritele, vaid ka igale saidil registreeritud kasutajale, n\u00e4iteks tellijast kasutajale, saidi varukoopia ja sellega seotud andmebaasi. <\/p>\n

UpdraftPlus'is varukoopiate laadimiseks kasutatakse identifikaatorit, mis genereeritakse varukoopia loomise kuup\u00e4eva ja juhusliku j\u00e4rjestuse (nonce) p\u00f5hjal. Probleem on selles, et WordPress'i heartbeat-p\u00e4ringute t\u00f6\u00f6tlejas puudub korralik kontroll ja h\u00e4kitud p\u00e4ringu kaudu saab iga kasutaja teavet viimasest varukoopiest, mis sisaldab ka aega ja sellega seotud juhuslikku j\u00e4rjestust. <\/p>\n

Edasi on v\u00f5imalik saadud teabe p\u00f5hjal luua identifikaator ja laadida varukoopia \u00fcles, kasutades e-posti kaudu laadimise meetodit. Selle meetodi puhul kasutatav funktsioon maybe_download_backup_from_email n\u00f5uab p\u00f6\u00f6rdumist lehe poole options-general.php, mis on saadaval ainult administraatorile. Siiski v\u00f5ib r\u00fcndaja selle piirangu k\u00f5rvale jalutada, pettes kontrollimiseks kasutatavat muutuja $pagenow ja saates p\u00e4ringu teenuse lehe kaudu, mis lubab ligip\u00e4\u00e4su mitteprivilegeeritud kasutajatele. N\u00e4iteks v\u00f5ib p\u00f6\u00f6rduda l\u00e4bi administraatorile teate saatmise lehe, saates p\u00e4ringu kujul «wp-admin\/admin-post.php\/\/wp-admin\/options-general.php?page=updraftplus».
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 1.22.3 \u0438 2.22.3, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c UpdraftPlus. UpdraftPlus \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103386","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Andmebaasi lekkimine WordPress'i lisas UpdraftPlus, millel on 3 miljonit installatsiooni | ProHoster","description":"WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0411\u0414 \u0432 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 3 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-19T07:36:57+00:00","article:modified_time":"2022-02-19T07:36:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-19 07:37:38","updated":"2022-10-06 02:55:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}