PT-2014-5714 · WordPress · Featured Comments

Tom Adams · Publicado 2014-06-16 · Atualizado 2014-06-17 · CVE-2014-4163

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Featured Comments plugin version 1.2.1 for WordPress

Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the buried or featured status of a comment. This is achieved via a request to "wp-admin/admin-ajax.php".

Recommendations For Featured Comments plugin version 1.2.1, update to a version that addresses the CSRF vulnerabilities to prevent authentication hijacking.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-4163

Produtos afetados

Featured Comments

Referências · 4

• 🔥 https://exploit-db.com/exploits/39213 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jun/62 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4163 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4163 · Nota