PT-2019-14683 · Unknown · Broken Link Checker

Publicado 2019-10-16 · Atualizado 2019-10-18 · CVE-2019-16521

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions through 1.11.8

Description The issue arises from improper encoding and insertion of an HTTP GET parameter into HTML, leading to Reflected XSS. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s filter GET parameter in a filter id=search request.

Recommendations For versions through 1.11.8, consider disabling the filter function on the broken links page until a resolution is available, as this product has reached its end-of-life and no further updates are expected.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16521

Produtos afetados

Broken Link Checker

Referências · 6

• 🔥 https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_Checker · Exploit
• 🔥 http://openwall.com/lists/oss-security/2019/10/16/3 · Exploit
• https://wordpress.org/plugins/broken-link-checker/#developers · Nota
• https://osv.dev/vulnerability/CVE-2019-16521 · Aviso do Fabricante
• https://wpvulndb.com/vulnerabilities/9917 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16521 · Nota de Segurança