PT-2017-7253 · WordPress · Resads

Publicado 2017-12-27 · Atualizado 2018-10-09 · CVE-2015-7667

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ResAds plugin versions prior to 1.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are located in the templates/admanagement/admanagement.php and templates/adspot/adspot.php files of the ResAds plugin for WordPress. The page parameter is used to inject the malicious script or HTML.

Recommendations For ResAds plugin versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the templates/admanagement/admanagement.php and templates/adspot/adspot.php files to minimize the risk of exploitation. Avoid using the page parameter in the affected files until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-7667

Produtos afetados

Resads

Referências · 5

• https://wordpress.org/plugins/resads/#developers · Aviso do Fabricante
• https://wpvulndb.com/vulnerabilities/8204 · Nota
• http://securityfocus.com/archive/1/536601/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7667 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7667 · Nota