CVE-2015-4414

Name of the Vulnerable Software and Affected Versions SE HTML5 Album Audio Player plugin versions 1.1.0 and earlier

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter of the download audio.php file. This is a directory traversal vulnerability.

Recommendations For SE HTML5 Album Audio Player plugin versions 1.1.0 and earlier, update to a version later than 1.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the download audio.php file until a patch is available. Avoid using the file parameter in the download audio.php file until the issue is resolved.