CVE-2015-7669

Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/archive/1/536597/100/0/threaded	Third Party Advisory VDB Entry
https://wordpress.org/plugins/easy2map/#developers	Release Notes Third Party Advisory
https://wpvulndb.com/vulnerabilities/8206	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:easy2map:easy2map:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2017-12-27 19:29

Updated : 2024-02-04 19:29

NVD link : CVE-2015-7669

Mitre link : CVE-2015-7669

CVE.ORG link : CVE-2015-7669

JSON object : View

Products Affected

easy2map

easy2map

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2015-7669", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-12-27T19:29:00.473", "references": [{"url": "http://www.securityfocus.com/archive/1/536597/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://wordpress.org/plugins/easy2map/#developers", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://wpvulndb.com/vulnerabilities/8206", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to \"upload file functionality.\""}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en (1) includes/MapImportCSV2.php y (2) includes/MapImportCSV.php en el plugin Easy2Map, en versiones anteriores a la 1.3.0 para WordPress, permiten que atacantes remotos incluyan y ejecuten archivos arbitrarios mediante el par\u00e1metro csvfile relacionado con la caracter\u00edstica de subida de archivos \"upload file functionality\"."}], "lastModified": "2019-05-07T14:10:47.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:easy2map:easy2map:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6C51EA51-39BA-46B6-9D52-E0B61BFE4DB9", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}