PT-2019-12530 · Yuzo · Yuzo Related Posts

Publicado 2019-05-09 · Atualizado 2019-05-13 · CVE-2019-11869

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Yuzo Related Posts plugin version 5.12.94

Description The issue arises from the plugin mistakenly assuming that the is admin() function verifies the request origin as an admin user, when in fact it only checks if the request is for an admin page. This allows an unauthenticated attacker to inject malicious payload into the plugin settings, such as the yuzo related post css and style setting.

Recommendations For Yuzo Related Posts plugin version 5.12.94, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the plugin settings to minimize the risk of malicious payload injection. Avoid using the yuzo related post css and style setting in the plugin until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-11869

Produtos afetados

Yuzo Related Posts

Referências · 5

• 🔥 https://wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11869 · Nota de Segurança
• https://pluginvulnerabilities.com/2019/03/30/wordpress-plugin-team-paints-target-on-exploitable-settings-change-vulnerability-that-permits-persistent-xss-in-related-posts · Nota
• https://wpvulndb.com/vulnerabilities/9254 · Nota
• https://osv.dev/vulnerability/CVE-2019-11869 · Aviso do Fabricante