PT-2018-4182 · WordPress · Buddypress

Pietro Oliva · Published 2018-04-10 · Updated 2019-04-26 · CVE-2014-1889

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Buddypress plugin versions prior to 1.9.2

Description The issue concerns a missing permissions check in the group creation process of the Buddypress plugin, allowing remote authenticated users to gain control of arbitrary groups.

Recommendations For versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1889

Affected Products

Buddypress

References · 7

• 🔥 http://securityfocus.com/archive/1/531050/100/0/threaded · Exploit
• 🔥 https://exploit-db.com/exploits/31571 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1889 · Security Note
• https://buddypress.org/2014/02/buddypress-1-9-2 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1889 · Note
• http://securityfocus.com/bid/65554 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91261 · Note