PT-2015-4053 · WordPress+1 · Xcloner+1

Larry W. Cashdollar + 1 · Publicado 2015-06-10 · Atualizado 2015-06-11 · CVE-2014-8607

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla!

Description The issue allows local users to obtain sensitive information, specifically the MySQL username and password, via the ps command. This is because the XCloner plugin provides these credentials on the command line.

Recommendations For XCloner plugin version 3.1.1 for WordPress, consider restricting access to the command line interface to minimize the risk of exploitation. For XCloner plugin version 3.5.1 for Joomla!, avoid using the plugin until a patch is available that properly secures the MySQL username and password. As a temporary workaround, consider disabling the XCloner plugin until a secure version is released.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-8607

Produtos afetados

Mysql Server

Xcloner

Referências · 5

• 🔥 http://vapid.dhs.org/advisory.php?v=110 · Exploit
• 🔥 https://exploit-db.com/exploits/35212 · Exploit
• 🔥 http://vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8607 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8607 · Nota