4.9

CVE-2022-0246

Exploit

iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip

iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip

The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Mögliche Gegenmaßnahme
iQ Block Country: Update to version 1.2.13, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Webence ≫ Iq Block Country SwPlatformwordpress Version < 1.2.13
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt iQ Block Country
Version [*, 1.2.13)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.4% 0.873
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/21e3d4a5-aaf3-4f42-8868-cd8c9bccd026
Third Party Advisory