PT-2015-4050 · WordPress+1 · Xcloner+1

Larry W. Cashdollar + 1 · Publicado 2015-06-10 · Atualizado 2015-06-11 · CVE-2014-8604

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description The issue allows remote attackers to obtain sensitive information, specifically the MySQL password in cleartext, via unspecified vectors. This occurs because the XCloner plugin returns the password to a text box in the configuration panel.

Recommendations For XCloner plugin version 3.1.1 for WordPress, consider disabling the configuration panel or restricting access to it until a fix is available. For XCloner plugin version 3.5.1 for Joomla!, avoid using the plugin's configuration panel to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-8604

Produtos afetados

Mysql Server

Xcloner

Referências · 5

• 🔥 https://exploit-db.com/exploits/35212 · Exploit
• 🔥 http://vapid.dhs.org/advisory.php?v=110 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8604 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8604 · Nota