Vulnerability Description
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Automattic | Woocommerce | <= 3.2.6 |
Related Weaknesses (CWE)
References
- https://github.com/woocommerce/woocommerce/issues/17964Third Party Advisory
- https://www.exploit-db.com/exploits/43196/Third Party AdvisoryVDB Entry
- https://www.exploit-db.com/ghdb/4613/Third Party AdvisoryVDB Entry
- https://github.com/woocommerce/woocommerce/issues/17964Third Party Advisory
- https://www.exploit-db.com/exploits/43196/Third Party AdvisoryVDB Entry
- https://www.exploit-db.com/ghdb/4613/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2017-17058?
CVE-2017-17058 is a vulnerability with a CVSS score of 7.5 (HIGH). The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a s...
How severe is CVE-2017-17058?
CVE-2017-17058 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-17058?
Check the references section above for vendor advisories and patch information. Affected products include: Automattic Woocommerce.