PT-2023-10290 · WordPress · Wooframework Branding Plugin

Jeffikus · Publicado 2023-06-05 · Atualizado 2024-05-17 · CVE-2015-10112

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WooFramework Branding Plugin versions up to 1.0.1

Description A problematic vulnerability has been found in the WooFramework Branding Plugin on WordPress. The issue affects the admin screen logic function of the file wooframework-branding.php. The manipulation of the url argument leads to an open redirect. This attack can be launched remotely.

Recommendations For WooFramework Branding Plugin versions up to 1.0.1, upgrade to version 1.0.2 to address this issue. As a temporary workaround, consider restricting the manipulation of the url argument in the admin screen logic function until the upgrade is applied.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2015-10112

Produtos afetados

Wooframework Branding Plugin

Referências · 5

• https://t.me/cibsecurity/64973 · Publicação no Telegram
• https://vuldb.com/?ctiid.230652 · Nota
• https://github.com/wp-plugins/wooframework-branding/commit/f12fccd7b5eaf66442346f748c901ef504742f78 · Correção
• https://vuldb.com/?id.230652 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-10112 · Nota de Segurança