PT-2018-6608 · Unknown · Z-Url Preview

Publicado 2018-01-01 · Atualizado 2018-01-11 · CVE-2017-18012

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Z-URL Preview plugin version 1.6.1

Description: The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the url parameter in the class.zlinkpreview.php file.

Recommendations: For Z-URL Preview plugin version 1.6.1, consider updating to a newer version that addresses this issue, if available. As a temporary workaround, restrict access to the class.zlinkpreview.php file to minimize the risk of exploitation. Avoid using the url parameter in the affected file until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-18012

Produtos afetados

Z-Url Preview

Referências · 7

• 🔥 https://wordpress.org/support/topic/z-url-preview-1-6-1-cross-site-scripting · Exploit
• 🔥 https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-18012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18012 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/8990 · Nota
• https://wordpress.org/plugins/z-url-preview/#developers · Nota
• https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txt · Aviso do Fabricante