PT-2014-2474 · WordPress · Events Manager Pro+1

Publicado 2014-05-13 · Atualizado 2014-05-20 · CVE-2013-1407

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Events Manager plugin versions prior to 5.3.5 Events Manager Pro plugin versions prior to 2.2.9

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the scope parameter to "index.php", user name, dbem phone, user email, or booking comment parameter to an event with registration enabled, and the wpnonce parameter to "wp-admin/edit.php".

Recommendations For Events Manager plugin versions prior to 5.3.5, update to version 5.3.5 or later. For Events Manager Pro plugin versions prior to 2.2.9, update to version 2.2.9 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-1407

Produtos afetados

Events Manager

Events Manager Pro

Referências · 5

• 🔥 https://htbridge.com/advisory/HTB23139 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html · Exploit
• http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1407 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1407 · Nota de Segurança