PT-2023-10284 · WordPress · Ip Blacklist Cloud Plugin

G0Blin · Publicado 2023-05-01 · Atualizado 2024-05-17 · CVE-2015-10105

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IP Blacklist Cloud Plugin versions up to 3.42

Description A critical vulnerability was found in the IP Blacklist Cloud Plugin on WordPress, affecting the valid js identifier function of the ip blacklist cloud.php file in the CSV File Import component. The manipulation of the filename argument leads to path traversal, and it is possible to initiate the attack remotely.

Recommendations For IP Blacklist Cloud Plugin versions up to 3.42, upgrade to version 3.43 to address this issue. As a temporary workaround, consider restricting access to the ip blacklist cloud.php file or disabling the valid js identifier function until the upgrade is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-10105

Produtos afetados

Ip Blacklist Cloud Plugin

Referências · 9

• https://github.com/wp-plugins/ip-blacklist-cloud/commit/6e6fe8c6fda7cbc252eef083105e08d759c07312 · Correção
• https://github.com/wp-plugins/ip-blacklist-cloud/releases/tag/3.43 · Correção
• https://t.me/cvenotify/64332 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10105 · Nota
• https://t.me/cvenotify/49453 · Publicação no Telegram
• https://vuldb.com/?id.227757 · Nota
• https://t.me/cibsecurity/63118 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-10105 · Nota de Segurança
• https://vuldb.com/?ctiid.227757 · Nota