PT-2019-7414
CVE-2015-9455
·
تاريخ النشر
2019-10-07
·
تاريخ التحديث
2019-10-10
الوصف من
CVSS 2.0
7.8
عاليةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:C
Name of the Vulnerable Software and Affected Versions
buddypress-activity-plus plugin version 1.6.1 and earlier
Description
The issue concerns a CSRF vulnerability with resultant directory traversal. This occurs via the "wp-admin/admin-ajax.php" API endpoint, specifically through the
bpfb photos[] parameter in a bpfb remove temp images action.Recommendations
For versions 1.6.1 and earlier, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the
bpfb remove temp images action and the bpfb photos[] parameter in the "wp-admin/admin-ajax.php" API endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾