PT-2015-5592 · WordPress · Easy Social Icons

Eric Flokstra · Published 2015-02-25 · Updated 2016-11-30 · CVE-2015-2084

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Easy Social Icons plugin versions prior to 1.2.3

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the image file parameter in an edit action in the "cnss social icon add" page to "wp-admin/admin.php".

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cnss social icon add" page in wp-admin/admin.php to minimize the risk of exploitation. Avoid using the image file parameter in the affected edit action until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-2084

Affected Products

Easy Social Icons

References · 8

• 🔥 http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Feb/76 · Exploit
• 🔥 https://exploit-db.com/exploits/36161 · Exploit
• 🔥 http://exploit-db.com/exploits/36161 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2084 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2084 · Note
• http://securityfocus.com/bid/74893 · Note
• https://wordpress.org/plugins/easy-social-icons/changelog · Note