PT-2015-5592 · WordPress · Easy Social Icons

Eric Flokstra · Publicado 2015-02-25 · Atualizado 2016-11-30 · CVE-2015-2084

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Easy Social Icons plugin versions prior to 1.2.3

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the image file parameter in an edit action in the "cnss social icon add" page to "wp-admin/admin.php".

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cnss social icon add" page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the image file parameter in the affected edit action until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-2084

Produtos afetados

Easy Social Icons

Referências · 8

• 🔥 http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Feb/76 · Exploit
• 🔥 https://exploit-db.com/exploits/36161 · Exploit
• 🔥 http://exploit-db.com/exploits/36161 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2084 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2084 · Nota
• http://securityfocus.com/bid/74893 · Nota
• https://wordpress.org/plugins/easy-social-icons/changelog · Nota