PT-2008-5945 · WordPress · Wp Comment Remix

G30Rg3_X · Published 2008-10-24 · Updated 2018-10-11 · CVE-2008-4734

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WP Comment Remix plugin versions prior to 1.4.4

Description A cross-site request forgery issue exists in the wpcr do options page function, allowing remote attackers to perform unauthorized actions as administrators. This can be achieved via a request that sets the wpcr hidden form input parameter.

Recommendations For WP Comment Remix plugin versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the wpcr do options page function to minimize the risk of exploitation. Avoid using the wpcr hidden form input parameter in affected requests until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-4734

Affected Products

Wp Comment Remix

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-4734 · Security Note
• http://secunia.com/advisories/32253 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4734 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45862 · Note
• http://chxsecurity.org/advisories/adv-3-full.txt · Note
• http://securityfocus.com/archive/1/497313/100/0/threaded · Note
• http://securityreason.com/securityalert/4492 · Note