PT-2015-4107 · Woltlab+1 · Woltlab Burning Board+1

Publicado 2015-01-15 · Atualizado 2018-10-09 · CVE-2014-8869

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions com.tapatalk.wbb4 plugin versions 1.x before 1.1.2 for Woltlab Burning Board 4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the app android id or app kindle url parameters in the welcome.php file of the mobiquo/smartbanner module. This can lead to cross-site scripting (XSS) attacks.

Recommendations For com.tapatalk.wbb4 plugin versions 1.x before 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the welcome.php file in the mobiquo/smartbanner module to minimize the risk of exploitation. Avoid using the app android id and app kindle url parameters in the affected module until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-8869

Produtos afetados

Woltlab Burning Board

Com.Tapatalk.Wbb4

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/31 · Exploit
• 🔥 http://securityfocus.com/bid/71997 · Exploit
• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-015/-cross-site-scripting-in-tapatalk-plugin-for-woltlab-burning-board-4-0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8869 · Nota de Segurança
• https://support.tapatalk.com/threads/tapatalk-for-woltlab-plugin-release-announcement-and-changelog.19540 · Aviso do Fabricante
• http://securityfocus.com/archive/1/534449/100/0/threaded · Nota