CVE-2015-9463 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
S3Bubble	S3Bubble-Amazon-S3-Audio-Streaming	2.0

Related Weaknesses (CWE)

CWE-22

References

http://packetstormsecurity.com/files/132578/ExploitThird Party AdvisoryVDB Entry
https://wordpress.org/plugins/s3bubble-amazon-s3-audio-streaming/#developersProductThird Party Advisory
http://packetstormsecurity.com/files/132578/ExploitThird Party AdvisoryVDB Entry
https://wordpress.org/plugins/s3bubble-amazon-s3-audio-streaming/#developersProductThird Party Advisory

FAQ

What is CVE-2015-9463?

CVE-2015-9463 is a vulnerability with a CVSS score of 7.5 (HIGH). The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

How severe is CVE-2015-9463?

CVE-2015-9463 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-9463?

Check the references section above for vendor advisories and patch information. Affected products include: S3Bubble S3Bubble-Amazon-S3-Audio-Streaming.