PT-2019-15200 · Blog2Social · Blog2Social

Publicado 2019-11-13 · Atualizado 2019-11-18 · CVE-2019-17550

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.9.0

Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the b2s id parameter. This occurs in the views/b2s/post.calendar.php component when the Administrator is logged in, and a reflected attack may execute upon a click on a malicious URL.

Recommendations For versions prior to 5.9.0, update to version 5.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the views/b2s/post.calendar.php component and avoiding use of the b2s id parameter until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-17550

Produtos afetados

Blog2Social

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-17550 · Nota de Segurança
• https://wordpress.org/plugins/blog2social/#developers · Nota
• https://plugins.trac.wordpress.org/log/blog2social · Nota
• https://wpvulndb.com/vulnerabilities/9948 · Nota
• https://plugins.trac.wordpress.org/changeset/2186043 · Correção
• https://osv.dev/vulnerability/CVE-2019-17550 · Aviso do Fabricante