PT-2015-4265 · WordPress · Cardoza-Facebook-Like-Box

Publicado 2015-01-05 · Atualizado 2015-01-06 · CVE-2014-9524

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cardoza-facebook-like-box plugin versions prior to 2.8.3 for WordPress

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting (XSS) attacks. The XSS attacks can be conducted via the frm title, frm url, frm border color, frm width, or frm height parameter in the "slug for fb like box" page to "wp-admin/admin.php".

Recommendations For versions prior to 2.8.3, update the cardoza-facebook-like-box plugin to version 2.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation. Avoid using the vulnerable parameters frm title, frm url, frm border color, frm width, or frm height in the affected page until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-9524

Produtos afetados

Cardoza-Facebook-Like-Box

Referências · 5

• 🔥 http://secunia.com/advisories/61557 · Exploit
• 🔥 http://packetstormsecurity.com/files/129506/WordPress-Facebook-Like-Box-2.8.2-CSRF-XSS.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9524 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9524 · Nota de Segurança
• https://wordpress.org/plugins/cardoza-facebook-like-box/changelog · Aviso do Fabricante