NVD Vulnerability Detail

CVE-2015-5065

Summary	Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.
Publication Date	June 24, 2015, 11:59 p.m.
Registration Date	Jan. 26, 2021, 2:52 p.m.
Last Update	Nov. 21, 2024, 11:32 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:intelligent-it:paypal_currency_converter_basic_for_woocommerce::::::wordpress::*					1.4

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html	Exploit Third Party Advisory VDB Entry
3	http://www.securityfocus.com/bid/75416	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/75416	Third Party Advisory VDB Entry
5	https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce	Third Party Advisory
6	https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce	Third Party Advisory
7	https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/	Patch Third Party Advisory
8	https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/	Patch Third Party Advisory
9	https://www.exploit-db.com/exploits/37253/	Exploit Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/37253/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

WordPress 用 Paypal Currency Converter Basic For WooCommerce プラグインににおける絶対パストラバーサルの脆弱性

Title	WordPress 用 Paypal Currency Converter Basic For WooCommerce プラグインににおける絶対パストラバーサルの脆弱性
Summary	WordPress 用 Paypal Currency Converter Basic For WooCommerce プラグインの google currency lookup の proxy.php には、絶対パストラバーサルの脆弱性が存在します。
Possible impacts	第三者により、requrl パラメータのフルパス名を介して、任意のファイルを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 11, 2015, midnight
Registration Date	June 25, 2015, 3:01 p.m.
Last Update	June 25, 2015, 3:01 p.m.

Affected System

Intelligent IT

PAYPAL CURRENCY CONVERTER BASIC FOR WOOCOMMERCE 1.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-5065	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5065
National Vulnerability Database (NVD)
2	CVE-2015-5065	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5065

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Intelligent IT
1	Top Page	http://intelligent-it.asia/
WordPress Plugin Changeset
2	Changeset 1179092 for paypal-currency-converter-basic-for-woocommerce	https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce
WordPress Plugin Directory
3	PAYPAL CURRENCY CONVERTER BASIC FOR WOOCOMMERCE	https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/

Change Log

No	Changed Details	Date of change
0	[2015年06月25日] 掲載	Feb. 17, 2018, 10:37 a.m.