PT-2018-18784 · WordPress · Events Manager

Luigi Gubello · Publicado 2018-03-26 · Atualizado 2024-10-08 · CVE-2018-9020

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Events Manager plugin versions prior to 5.8.1.2

Description The issue allows for XSS via the mapTitle parameter in the Google Maps miniature within the events-manager.js file.

Recommendations For versions prior to 5.8.1.2, update to version 5.8.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the events-manager.js file or avoiding the use of the mapTitle parameter in the Google Maps miniature until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-9020

Produtos afetados

Events Manager

Referências · 7

• 🔥 https://gubello.me/blog/events-manager-authenticated-stored-xss · Exploit
• https://t.me/cvenotify/97413 · Publicação no Telegram
• http://wp-events-plugin.com/blog/2018/01/15/events-manager-5-8-1-2-security-release · Nota
• https://wordpress.org/plugins/events-manager/#developers · Nota
• https://youtube.com/watch?v=40d7uXl36O4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-9020 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-9020 · Aviso do Fabricante