PT-2014-8710 · Goywp · Goywp Webpress

Jing Wang · Publicado 2014-12-16 · Atualizado 2014-12-17 · CVE-2014-8751

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions goYWP WebPress version 13.00.06

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include search param to the "search.php" endpoint, and name, address, or comment parameters to the "forms.php" endpoint.

Recommendations For goYWP WebPress version 13.00.06, as a temporary workaround, consider validating and sanitizing user input for the search param parameter in "search.php" and the name, address, and comment parameters in "forms.php" to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-8751

Produtos afetados

Goywp Webpress

Referências · 4

• http://seclists.org/fulldisclosure/2014/Dec/34 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8751 · Nota de Segurança
• http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8751 · Nota