PT-2012-2203 · Sentinel · Sentinel

Publicado 2012-10-25 · Atualizado 2017-08-29 · CVE-2011-5226

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sentinel plugin version 1.0.0

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.

Recommendations For Sentinel plugin version 1.0.0, consider disabling the wordpress sentinel.php file until a patch is available to prevent exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-5226

Produtos afetados

Sentinel

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/71857 · Nota
• http://osvdb.org/77778 · Nota
• http://boiteaweb.fr/wordpress-sentinel-v1-0-0-3104.html · Aviso do Fabricante
• http://wordpress.org/extend/plugins/wordpress-sentinel/changelog · Nota
• http://secunia.com/advisories/47020 · Aviso do Fabricante
• http://plugins.trac.wordpress.org/changeset?reponame=&new=475315%40wordpress-sentinel&old=474998%40wordpress-sentinel · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5226 · Nota de Segurança
• http://securityfocus.com/bid/51089 · Nota