PT-2015-3688 · Nokia · Nokia Maps & Places Plugin

Puneeth Gowda · Published 2015-07-01 · Updated 2016-05-27 · CVE-2014-1750

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nokia Maps & Places plugin version 1.6.6

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the href parameter to the "page/place.html" endpoint. Initially, it was reported as a cross-site scripting (XSS) vulnerability, but this classification may be inaccurate.

Recommendations For Nokia Maps & Places plugin version 1.6.6, consider disabling the href parameter in the "page/place.html" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the href parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2014-1750

Affected Products

Nokia Maps & Places Plugin

References · 7

• 🔥 http://seclists.org/oss-sec/2014/q1/173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1750 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1750 · Note
• http://securityfocus.com/bid/65226 · Note
• https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=841883 · Note
• http://seclists.org/oss-sec/2014/q1/181 · Note
• https://plugins.trac.wordpress.org/browser/nokia-mapsplaces/trunk/nokia-mapsplaces.php?rev=842384 · Note