PT-2014-2460 · WordPress · Mingle Forum

Publicado 2014-03-28 · Atualizado 2017-08-29 · CVE-2013-0734

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mingle Forum plugin versions prior to 1.0.34

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the search words parameter in a search action to "wpf.class.php" or the togroupusers parameter in an add user togroup action to "fs-admin/fs-admin.php".

Recommendations For versions prior to 1.0.34, update to version 1.0.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wpf.class.php" and "fs-admin/fs-admin.php" files until the update is applied. Avoid using the search words and togroupusers parameters in the affected actions until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-0734

Produtos afetados

Mingle Forum

Referências · 8

• http://osvdb.org/90433 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0734 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82187 · Nota
• http://secunia.com/advisories/52167 · Aviso do Fabricante
• http://securityfocus.com/bid/58059 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0734 · Nota de Segurança
• http://secunia.com/secunia_research/2013-3 · Aviso do Fabricante
• http://osvdb.org/90432 · Nota