{"id":103386,"date":"2022-02-19T09:36:57","date_gmt":"2022-02-19T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok"},"modified":"2022-02-19T09:36:57","modified_gmt":"2022-02-19T07:36:57","slug":"utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","title":{"rendered":"WordPressi lisandmoodulis UpdraftPlus, kus on 3 miljonit installatsiooni, leiti andmebaasi lekke probleem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPressi pluginas UpdraftPlus, millel on \u00fcle 3 miljoni aktiivse paigaldamise, avastati ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab volitamata kasutajal alla laadida saidi andmebaasi koopia, milles on lisaks sisule ka k\u00f5igi kasutajate seaded ja paroolide r\u00e4si. Probleem lahendati versioonides 1.22.3 ja 2.22.3, mida soovitatakse k\u00f5igil UpdraftPlus'i kasutajatel v\u00f5imalikult kiiresti installida. <\/p>\n

UpdraftPlusit peetakse k\u00f5ige populaarsemaks plugina varukoopiate tegemiseks WordPressi platvormil. Vale juurdep\u00e4\u00e4su kontrolli t\u00f5ttu v\u00f5imaldas plugina kaudu alla laadida saidi varukoopia ja sellega seotud andmebaasi mitte ainult administraatoritel, vaid ka igal registreeritud kasutajal, n\u00e4iteks tellijast kasutajal. <\/p>\n

UpdraftPlus'i varukoopiate laadimiseks kasutatakse identifikaatorit, mis genereeritakse varukoopia loomise aja ja juhusliku j\u00e4rjestuse (nonce) p\u00f5hjal. Probleem seisneb selles, et WordPressi heartbeat-p\u00e4ringute t\u00f6\u00f6tleja vajalike kontrollide puudumise t\u00f5ttu saab mistahes kasutaja spetsiaalselt vormistatud p\u00e4ringu abil teavet viimase varukoopia kohta, sealhulgas teavet aja ja seotud juhusliku j\u00e4rjestuse kohta. <\/p>\n

Edasi, saadud teabe p\u00f5hjal on v\u00f5imalik luua identifikaator ja laadida varukoopia, kasutades e-posti kaudu laadimise meetodit. Selle meetodi raames n\u00f5uab funktsioon maybe_download_backup_from_email juurdep\u00e4\u00e4su lehele options-general.php, mis on saadaval ainult administraatorile. Siiski saab r\u00fcndaja selle piiri \u00fcletada, pettes kasutatavat muutuja $pagenow kontrollimisel ja saates p\u00e4ringu kaudu teeninduse lehe, mis lubab t\u00f6\u00f6tlemise \u00f5igusi mitteomavaid kasutajaid. N\u00e4iteks saab p\u00f6\u00f6rduda kaudu administreerimise s\u00f5numite saatmise lehe, saates p\u00e4ringu vormis \"wp-admin\/admin-post.php\/\/wp-admin\/options-general.php?page=updraftplus\".
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 1.22.3 \u0438 2.22.3, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c UpdraftPlus. UpdraftPlus \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103386","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 WordPressi pluginis UpdraftPlus, millel on 3 miljonit installi, avastati andmelekke | ProHoster","description":"WordPressi lisandmoodulis UpdraftPlus, millel on \u00fcle 3 miljoni aktiivse paigaldamise, tuvastati ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmanda osapoole kasutajal laadida \u00fcles saidi andmebaasi koopia, kus lisaks sisule on ka k\u00f5igi kasutajate parameetrid ja paroolide hash'id. Probleem on lahendatud v\u00e4ljaannetes 1.22.3 ja 2.22.3, mille soovitatakse k\u00f5igil UpdraftPlus'i kasutajatel v\u00f5imalikult kiiresti paigaldada. UpdraftPlus esitatakse kui k\u00f5ige populaarsem lisandmoodul.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0411\u0414 \u0432 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 3 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 1.22.3 \u0438 2.22.3, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c UpdraftPlus. UpdraftPlus \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-19T07:36:57+00:00","article:modified_time":"2022-02-19T07:36:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-19 07:37:38","updated":"2022-10-06 02:55:30"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}