{"id":103386,"date":"2022-02-19T09:36:57","date_gmt":"2022-02-19T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok"},"modified":"2022-02-19T09:36:57","modified_gmt":"2022-02-19T07:36:57","slug":"utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","title":{"rendered":"WordPressi plugina UpdraftPlus andmebaasi lekkimine, millel on 3 miljonit installi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule on ka k\u00f5igi kasutajate parameetrid ja paroolide r\u00e4si. Probleem on lahendatud versioonides 1.22.3 ja 2.22.3, mille paigaldamist soovitatakse k\u00f5igile UpdraftPlus kasutajatele niipea kui v\u00f5imalik. <\/p>\n

UpdraftPlus esitleb ennast kui k\u00f5ige populaarsemat lisandmoodulit veebisaitide varundamiseks, mis toimivad WordPress'i platvormil. Vale juurdep\u00e4\u00e4su kontrollimise t\u00f5ttu v\u00f5imaldas lisa laadida mitte ainult administraatoritele, vaid ka igale saidil registreeritud kasutajale, n\u00e4iteks tellijast kasutajale, saidi varukoopia ja sellega seotud andmebaasi. <\/p>\n

UpdraftPlus'is varukoopiate laadimiseks kasutatakse identifikaatorit, mis genereeritakse varukoopia loomise kuup\u00e4eva ja juhusliku j\u00e4rjestuse (nonce) p\u00f5hjal. Probleem on selles, et WordPress'i heartbeat-p\u00e4ringute t\u00f6\u00f6tlejas puudub korralik kontroll ja h\u00e4kitud p\u00e4ringu kaudu saab iga kasutaja teavet viimasest varukoopiest, mis sisaldab ka aega ja sellega seotud juhuslikku j\u00e4rjestust. <\/p>\n

Seej\u00e4rel saadakse, et luua identifikaator ja laadida varukoopia, kasutades e-posti kaudu laadimise meetodit. Selle meetodi puhul n\u00f5utav funktsioon maybe_download_backup_from_email vajab juurdep\u00e4\u00e4su lehele options-general.php, mis on saadaval ainult administraatorile. Siiski v\u00f5ib r\u00fcndaja seda piirangut minna \u00fcle petmise kaudu, mis on seotud kontrollitud muutujaga $pagenow, ja saata p\u00e4ringu kaudu teenuseleht, mis lubab juurdep\u00e4\u00e4su mitteprivileegitud kasutajatele. N\u00e4iteks saab p\u00f6\u00f6rduda administraatori s\u00f5numi saatmise lehe kaudu, saates p\u00e4ringu kujul 'wp-admin\/admin-post.php\/\/wp-admin\/options-general.php?page=updraftplus'.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 1.22.3 \u0438 2.22.3, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c UpdraftPlus. UpdraftPlus \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103386","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Andmebaasi lekkimine WordPress'i lisas UpdraftPlus, millel on 3 miljonit installatsiooni | ProHoster","description":"WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0411\u0414 \u0432 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 3 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-19T07:36:57+00:00","article:modified_time":"2022-02-19T07:36:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-19 07:37:38","updated":"2022-10-06 02:55:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}