PT-2015-6523 · WordPress · Xcloner

Larry W. Cashdollar + 1 · Published 2015-06-17 · Updated 2015-06-18 · CVE-2015-4337

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.2 for WordPress

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the excl manual parameter in the "xcloner show" page to "wpadmin/plugins.php".

Recommendations For XCloner plugin version 3.1.2, consider disabling access to the xcloner show page in wpadmin/plugins.php until a patch is available, and avoid using the excl manual parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-4337

Affected Products

Xcloner

References · 5

• 🔥 http://vapid.dhs.org/advisory.php?v=121 · Exploit
• 🔥 http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4337 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4337 · Note
• http://securityfocus.com/bid/74943 · Note