PT-2023-9944 · Madgicweb · Madgicweb Buddystream Plugin

Blackphantom · Publicado 2023-02-19 · Atualizado 2024-05-17 · CVE-2012-10007

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions madgicweb BuddyStream Plugin versions up to 3.2.7

Description A vulnerability was found in the madgicweb BuddyStream Plugin. It has been declared as problematic. The issue affects an unknown functionality of the file ShareBox.php. The manipulation of the content/link/shares argument leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue.

Recommendations For madgicweb BuddyStream Plugin versions up to 3.2.7, upgrade to version 3.2.8 to address the issue. As a temporary workaround, consider restricting access to the ShareBox.php file until the upgrade is applied. Avoid using the content/link/shares argument in the affected functionality until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-10007

Produtos afetados

Madgicweb Buddystream Plugin

Referências · 8

• https://github.com/madgicweb/buddystream/commit/7d5b9a89a27711aad76fd55ab4cc4185b545a1d0 · Correção
• https://github.com/madgicweb/buddystream/releases/tag/3.2.8 · Correção
• https://vuldb.com/?id.221479 · Nota
• https://vuldb.com/?ctiid.221479 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-10007 · Nota de Segurança
• https://t.me/cvenotify/44664 · Publicação no Telegram
• https://t.me/cibsecurity/58510 · Publicação no Telegram
• https://t.me/cvenotify/59365 · Publicação no Telegram