PT-2014-8710 · Goywp · Goywp Webpress

Jing Wang · Published 2014-12-16 · Updated 2014-12-17 · CVE-2014-8751

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions goYWP WebPress version 13.00.06

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include search param to the "search.php" endpoint, and name, address, or comment parameters to the "forms.php" endpoint.

Recommendations For goYWP WebPress version 13.00.06, as a temporary workaround, consider validating and sanitizing user input for the search param parameter in "search.php" and the name, address, and comment parameters in "forms.php" to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8751

Affected Products

Goywp Webpress

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-8751 · Security Note
• http://seclists.org/fulldisclosure/2014/Dec/34 · Note
• http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8751 · Note