PT-2019-7431 · WordPress · Incoming-Links Plugin

Deconf · Publicado 2019-10-10 · Atualizado 2019-10-15 · CVE-2015-9472

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions incoming-links plugin versions prior to 0.9.10b for WordPress

Description The issue allows for XSS via the Referer HTTP header in the referrers.php file.

Recommendations For versions prior to 0.9.10b, update to version 0.9.10b or later to resolve the issue. As a temporary workaround, consider restricting access to the referrers.php file until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-9472

Produtos afetados

Incoming-Links Plugin

Referências · 6

• https://wordpress.org/plugins/incoming-links/#developers · Nota
• https://plugins.trac.wordpress.org/changeset/1080044/incoming-links · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-9472 · Nota de Segurança
• https://t.me/cibsecurity/7344 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9472 · Nota
• https://wpvulndb.com/vulnerabilities/8015 · Nota