PT-2015-3688 · Nokia · Nokia Maps & Places Plugin

Puneeth Gowda · Publicado 2015-07-01 · Atualizado 2016-05-27 · CVE-2014-1750

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nokia Maps & Places plugin version 1.6.6

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the href parameter to the "page/place.html" endpoint. Initially, it was reported as a cross-site scripting (XSS) vulnerability, but this classification may be inaccurate.

Recommendations For Nokia Maps & Places plugin version 1.6.6, consider disabling the href parameter in the "page/place.html" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the href parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2014-1750

Produtos afetados

Nokia Maps & Places Plugin

Referências · 7

• 🔥 http://seclists.org/oss-sec/2014/q1/173 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1750 · Nota
• http://securityfocus.com/bid/65226 · Nota
• https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=841883 · Nota
• http://seclists.org/oss-sec/2014/q1/181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1750 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=842384 · Nota