PT-2012-2203 · Sentinel · Sentinel

Published 2012-10-25 · Updated 2017-08-29 · CVE-2011-5226

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sentinel plugin version 1.0.0

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots.

Recommendations For Sentinel plugin version 1.0.0, consider disabling the wordpress sentinel.php file until a patch is available to prevent exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-5226

Affected Products

Sentinel

References · 8

• http://boiteaweb.fr/wordpress-sentinel-v1-0-0-3104.html · Vendor Advisory
• http://secunia.com/advisories/47020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-5226 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71857 · Note
• http://osvdb.org/77778 · Note
• http://wordpress.org/extend/plugins/wordpress-sentinel/changelog · Note
• http://plugins.trac.wordpress.org/changeset?reponame=&new=475315%40wordpress-sentinel&old=474998%40wordpress-sentinel · Note
• http://securityfocus.com/bid/51089 · Note