PT-2019-18281 · Frederick Townes · W3 Total Cache

Published 2019-04-01 · Updated 2023-05-26 · CVE-2019-6715

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions W3 Total Cache plugin versions prior to 0.9.4

Description The issue allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data. This is due to a lack of proper access control in the API, which can be exploited by modifying the user ID in the API request. The problem affects the Toyota GAZOO Racing (TGR) application, which provides location tracking functionality for users. Additionally, a similar issue was found in the official Ferrari website, which was using an outdated version of the W3 Total Cache plugin.

Recommendations For W3 Total Cache plugin versions prior to 0.9.4, update to version 0.9.4 or later to resolve the issue. As a temporary workaround, consider disabling the pub/sns.php file until a patch is available. Restrict access to the SubscribeURL field in the SubscriptionConfirmation JSON data to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-6715

Affected Products

W3 Total Cache

References · 7

• 🔥 https://github.com/random-robbie/cve-2019-6715 · Exploit
• 🔥 https://vinhjaxt.github.io/2019/03/cve-2019-6715 · Exploit
• 🔥 http://packetstormsecurity.com/files/160674/WordPress-W3-Total-Cache-0.9.3-File-Read-Directory-Traversal.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-6715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6715 · Security Note
• https://t.me/cvenotify/7635 · Telegram Post
• https://t.me/true_secator/4382 · Telegram Post