PT-2015-4280 · Mywebsiteadvisor · Mywebsiteadvisor Simple Security
Publicado
2015-01-15
·
Atualizado
2018-10-09
·
CVE-2014-9570
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
datefilter parameter in the "access log" page to "wp-admin/users.php" or the simple security ip blacklist[] parameter in an "add blacklist ip" action in the "ip blacklist" page to "wp-admin/users.php".Recommendations
For MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier, consider disabling the access to the "access log" and "ip blacklist" pages in "wp-admin/users.php" until a patch is available. Avoid using the
datefilter and simple security ip blacklist[] parameters in the affected pages until the issue is resolved.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mywebsiteadvisor Simple Security