PT-2016-3497 · Nex · Nex-Forms Lite

Publicado 2016-01-08 · Atualizado 2016-01-12 · CVE-2014-7151

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NEX-Forms Lite plugin version 2.1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the form fields parameter in a (1) do edit or (2) do insert action to the "/wp-admin/admin-ajax.php" API endpoint.

Recommendations For NEX-Forms Lite plugin version 2.1.0, consider disabling the form fields parameter in the affected API endpoint until a patch is available. Restrict access to the /wp-admin/admin-ajax.php endpoint to minimize the risk of exploitation. Avoid using the form fields parameter in do edit or do insert actions until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-7151

Produtos afetados

Nex-Forms Lite

Referências · 4

• 🔥 https://research.g0blin.co.uk/cve-2014-7151 · Exploit
• https://wpvulndb.com/vulnerabilities/8237 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7151 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7151 · Nota de Segurança