PT-2017-7255 · WordPress · Easy2Map

Published 2017-12-27 · Updated 2019-05-07 · CVE-2015-7669

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Easy2Map plugin versions prior to 1.3.0

Description The issue concerns directory traversal vulnerabilities in the Easy2Map plugin for WordPress. Specifically, the vulnerabilities are located in the includes/MapImportCSV2.php and includes/MapImportCSV.php files. These vulnerabilities allow remote attackers to include and execute arbitrary files via the csvfile parameter, which is related to the "upload file functionality."

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/MapImportCSV2.php and includes/MapImportCSV.php files to minimize the risk of exploitation. Avoid using the csvfile parameter in the affected functionality until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-7669

Affected Products

Easy2Map

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-7669 · Security Note
• https://wpvulndb.com/vulnerabilities/8206 · Note
• https://wordpress.org/plugins/easy2map/#developers · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7669 · Note
• http://securityfocus.com/archive/1/536597/100/0/threaded · Note