PT-2023-10284 · WordPress · Ip Blacklist Cloud Plugin

G0Blin · Published 2023-05-01 · Updated 2024-05-17 · CVE-2015-10105

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IP Blacklist Cloud Plugin versions up to 3.42

Description A critical vulnerability was found in the IP Blacklist Cloud Plugin on WordPress, affecting the valid js identifier function of the ip blacklist cloud.php file in the CSV File Import component. The manipulation of the filename argument leads to path traversal, and it is possible to initiate the attack remotely.

Recommendations For IP Blacklist Cloud Plugin versions up to 3.42, upgrade to version 3.43 to address this issue. As a temporary workaround, consider restricting access to the ip blacklist cloud.php file or disabling the valid js identifier function until the upgrade is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-10105

Affected Products

Ip Blacklist Cloud Plugin

References · 9

• https://github.com/wp-plugins/ip-blacklist-cloud/commit/6e6fe8c6fda7cbc252eef083105e08d759c07312 · Patch
• https://github.com/wp-plugins/ip-blacklist-cloud/releases/tag/3.43 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10105 · Security Note
• https://t.me/cvenotify/64332 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10105 · Note
• https://t.me/cvenotify/49453 · Telegram Post
• https://vuldb.com/?id.227757 · Note
• https://t.me/cibsecurity/63118 · Telegram Post
• https://vuldb.com/?ctiid.227757 · Note