PT-2015-5329 · WordPress · Fancybox

Areohdeee + 11 · Publicado 2015-02-17 · Atualizado 2021-09-13 · CVE-2015-1494

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a mfbfw[*] parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wild, as demonstrated by the mfbfw[padding] parameter.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-post.php" endpoint to minimize the risk of exploitation. Avoid using the mfbfw[*] parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-1494

Produtos afetados

Fancybox

Referências · 11

• 🔥 https://exploit-db.com/exploits/36087 · Exploit
• 🔥 http://exploit-db.com/exploits/36087 · Exploit
• 🔥 https://wordpress.org/support/topic/possible-malware-2 · Exploit
• http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html · Nota
• https://plugins.trac.wordpress.org/changeset/1082625 · Nota
• http://openwall.com/lists/oss-security/2015/02/05/10 · Nota
• https://wordpress.org/plugins/fancybox-for-wordpress/changelog · Correção
• http://securityfocus.com/bid/72506 · Nota
• http://osvdb.org/show/osvdb/118543 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1494 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1494 · Nota de Segurança