CVE-2015-9464 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
S3Bubble	S3Bubble-Amazon-S3-Html-5-Video-With-Adverts	0.7

Related Weaknesses (CWE)

CWE-22

References

https://wordpress.org/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/#deveProduct
https://www.exploit-db.com/exploits/37494ExploitThird Party AdvisoryVDB Entry
https://wordpress.org/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/#deveProduct
https://www.exploit-db.com/exploits/37494ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2015-9464?

CVE-2015-9464 is a vulnerability with a CVSS score of 7.5 (HIGH). The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

How severe is CVE-2015-9464?

CVE-2015-9464 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-9464?

Check the references section above for vendor advisories and patch information. Affected products include: S3Bubble S3Bubble-Amazon-S3-Html-5-Video-With-Adverts.