PT-2015-4280 · Mywebsiteadvisor · Mywebsiteadvisor Simple Security

Published 2015-01-15 · Updated 2018-10-09 · CVE-2014-9570

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the datefilter parameter in the "access log" page to "wp-admin/users.php" or the simple security ip blacklist[] parameter in an "add blacklist ip" action in the "ip blacklist" page to "wp-admin/users.php".

Recommendations For MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier, consider disabling the access to the "access log" and "ip blacklist" pages in "wp-admin/users.php" until a patch is available. Avoid using the datefilter and simple security ip blacklist[] parameters in the affected pages until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9570

Affected Products

Mywebsiteadvisor Simple Security

References · 4

• 🔥 https://htbridge.com/advisory/HTB23244 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9570 · Security Note
• http://securityfocus.com/archive/1/534477/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9570 · Note