PT-2011-2614 · WordPress · Wp-Recaptcha

Publicado 2011-03-22 · Atualizado 2017-08-17 · CVE-2011-0759

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WP-reCAPTCHA plugin version 2.9.8.2

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page of the WP-reCAPTCHA plugin for WordPress. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, potentially leading to the disabling of the CAPTCHA requirement or the insertion of cross-site scripting (XSS) sequences. The vulnerable parameters include recaptcha opt pubkey, recaptcha opt privkey, re tabindex, error blank, error incorrect, mailhide pub, mailhide priv, mh replace link, and mh replace title.

Recommendations For WP-reCAPTCHA plugin version 2.9.8.2, consider disabling the configuration page or restricting access to it until a patch is available. Avoid using the vulnerable parameters in the configuration page to minimize the risk of exploitation. As a temporary workaround, restrict the ability to disable the CAPTCHA requirement or insert XSS sequences via the configuration page. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-0759

Produtos afetados

Wp-Recaptcha

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/66167 · Nota
• http://secunia.com/advisories/43771 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/fulldisclosure/2011-03/0206.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0759 · Nota
• http://securityfocus.com/bid/46909 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0759 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66169 · Nota