PT-2015-7577 · WordPress · Wordpress Font Plugin

Publicado 2015-10-16 · Atualizado 2018-10-09 · CVE-2015-7683

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Font plugin versions prior to 7.5.1

Description The issue allows remote administrators to read arbitrary files due to an absolute path traversal vulnerability in the Font.php file of the Font plugin for WordPress. This can be achieved by providing a full pathname in the url parameter to the "AjaxProxy.php" endpoint.

Recommendations For WordPress Font plugin versions prior to 7.5.1, update to version 7.5.1 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-7683

Produtos afetados

Wordpress Font Plugin

Referências · 6

• 🔥 http://packetstormsecurity.com/files/133930/WordPress-Font-7.5-Path-Traversal.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7683 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7683 · Nota de Segurança
• https://wordpress.org/plugins/font/changelog · Correção
• http://securityfocus.com/archive/1/536670/100/0/threaded · Nota
• https://wpvulndb.com/vulnerabilities/8214 · Nota