CVE-2022-0246
Medium
Description
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
SeverityMedium
CVSS4.9
Exploit probability—
ProductWebence Iq Block Country
PublishedApr 11, 2022
First seenApr 11, 2022
Weakness typeCWE-73CWE-73
How to fix
Update
- webence iq_block_country1.2.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webence iq_block_country | v < 1.2.13 | 1.2.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.