PT-2008-5945 · WordPress · Wp Comment Remix

G30Rg3_X · Publicado 2008-10-24 · Atualizado 2018-10-11 · CVE-2008-4734

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WP Comment Remix plugin versions prior to 1.4.4

Description A cross-site request forgery issue exists in the wpcr do options page function, allowing remote attackers to perform unauthorized actions as administrators. This can be achieved via a request that sets the wpcr hidden form input parameter.

Recommendations For WP Comment Remix plugin versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the wpcr do options page function to minimize the risk of exploitation. Avoid using the wpcr hidden form input parameter in affected requests until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-4734

Produtos afetados

Wp Comment Remix

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4734 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4734 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45862 · Nota
• http://chxsecurity.org/advisories/adv-3-full.txt · Nota
• http://secunia.com/advisories/32253 · Aviso do Fabricante
• http://securityfocus.com/archive/1/497313/100/0/threaded · Nota
• http://securityreason.com/securityalert/4492 · Nota