PT-2019-15180 · Cleantalk · Cleantalk-Spam-Protect

Glomberg · Publicado 2019-11-13 · Atualizado 2019-11-18 · CVE-2019-17515

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cleantalk-spam-protect plugin versions prior to 5.127.4

Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. This is possible when the Administrator is logged in and a reflected attack may execute upon a click on a malicious URL. The components affected are inc/cleantalk-users.php and inc/cleantalk-comments.php.

Recommendations For versions prior to 5.127.4, update to version 5.127.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the inc/cleantalk-users.php and inc/cleantalk-comments.php components to minimize the risk of exploitation. Avoid using the from or till parameter in affected URLs until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-17515

Produtos afetados

Cleantalk-Spam-Protect

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-17515 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17515 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/2172333 · Correção
• https://wpvulndb.com/vulnerabilities/9949 · Nota
• https://wordpress.org/plugins/cleantalk-spam-protect/#developers · Nota