PT-2015-5162 · WordPress · Wp Slimstat

Publicado 2015-01-21 · Atualizado 2015-01-23 · CVE-2015-1204

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2

Description A cross-site scripting (XSS) issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the "wp-slim-view-2" page to "wp-admin/admin.php".

Recommendations For WP Slimstat plugin versions prior to 3.9.2, update to version 3.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Save Filters functionality until the update is applied. Avoid using the fs[resource] parameter in the affected page until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-1204

Produtos afetados

Wp Slimstat

Referências · 5

• 🔥 https://wpvulndb.com/vulnerabilities/7744 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1204 · Nota de Segurança
• https://wordpress.org/plugins/wp-slimstat/changelog · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1204 · Nota
• http://secunia.com/advisories/62034 · Nota