PT-2014-5944 · WordPress · Alipay Plugin

Waisir · Publicado 2014-10-21 · Atualizado 2015-01-24 · CVE-2014-4514

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Alipay plugin versions 3.6.0 and earlier for WordPress

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is related to the getDebugInfo function.

Recommendations For Alipay plugin versions 3.6.0 and earlier, update to a version later than 3.6.0 to resolve the issue. As a temporary workaround, consider disabling the getDebugInfo function until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-4514

Produtos afetados

Alipay Plugin

Referências · 4

• 🔥 http://codevigilant.com/disclosure/wp-plugin-alipay-a3-cross-site-scripting-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4514 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/847094 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4514 · Nota