PT-2017-7255 · WordPress · Easy2Map

Publicado 2017-12-27 · Atualizado 2019-05-07 · CVE-2015-7669

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Easy2Map plugin versions prior to 1.3.0

Description The issue concerns directory traversal vulnerabilities in the Easy2Map plugin for WordPress. Specifically, the vulnerabilities are located in the includes/MapImportCSV2.php and includes/MapImportCSV.php files. These vulnerabilities allow remote attackers to include and execute arbitrary files via the csvfile parameter, which is related to the "upload file functionality."

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/MapImportCSV2.php and includes/MapImportCSV.php files to minimize the risk of exploitation. Avoid using the csvfile parameter in the affected functionality until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-7669

Produtos afetados

Easy2Map

Referências · 5

• https://wpvulndb.com/vulnerabilities/8206 · Nota
• https://wordpress.org/plugins/easy2map/#developers · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7669 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7669 · Nota de Segurança
• http://securityfocus.com/archive/1/536597/100/0/threaded · Nota