PT-2018-17066 · WordPress · Read-And-Understood Plugin

Publicado 2018-01-13 · Atualizado 2018-01-23 · CVE-2018-5667

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1

Description: A security issue exists in the read-and-understood plugin for WordPress, where cross-site scripting (XSS) is possible. This occurs via the "wp-admin/options-general.php" endpoint, specifically through the rnu username validation pattern parameter.

Recommendations: For read-and-understood plugin version 2.1, update the plugin to a version that fixes this issue or consider disabling the plugin until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the "wp-admin/options-general.php" endpoint to minimize the risk of XSS attacks. Avoid using the rnu username validation pattern parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-5667

Produtos afetados

Read-And-Understood Plugin

Referências · 3

• 🔥 https://github.com/d4wner/Vulnerabilities-Report/blob/master/read-and-understood.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-5667 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5667 · Nota de Segurança