PT-2014-6417 · WordPress · Wordpress Mobile Pack

Mallory Adams · Publicado 2014-08-29 · Atualizado 2018-11-19 · CVE-2014-5337

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Mobile Pack plugin versions prior to 2.0.2

Description The issue allows remote attackers to obtain sensitive information by exploiting improper access restrictions to password-protected posts. This can be achieved via an "exportarticles" action to the "export/content.php" endpoint.

Recommendations For WordPress Mobile Pack plugin versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-5337

Produtos afetados

Wordpress Mobile Pack

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb · Exploit
• 🔥 https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts · Exploit
• http://secunia.com/advisories/60584 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5337 · Nota
• http://wordpress.org/plugins/wordpress-mobile-pack/changelog · Correção
• http://securityfocus.com/bid/69292 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5337 · Nota de Segurança