PT-2015-4082 · WordPress · Pie Register

Publicado 2015-01-23 · Atualizado 2015-01-26 · CVE-2014-8802

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.14

Description The issue allows remote attackers to add a user by uploading a crafted CSV file or activate a user account via a verifyit action due to improper access restriction to certain functions in pie-register.php.

Recommendations For versions prior to 2.0.14, update to version 2.0.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the pie-register.php file until a patch is available. Avoid using the verifyit action in the affected plugin until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-8802

Produtos afetados

Pie Register

Referências · 6

• 🔥 https://exploit-db.com/exploits/35823 · Exploit
• 🔥 http://security.szurek.pl/pie-register-2013-privilege-escalation.html · Exploit
• https://wordpress.org/plugins/pie-register/changelog · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-8802 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8802 · Nota
• http://secunia.com/advisories/62351 · Nota