PT-2019-15180 · Cleantalk · Cleantalk-Spam-Protect

Glomberg · Published 2019-11-13 · Updated 2019-11-18 · CVE-2019-17515

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cleantalk-spam-protect plugin versions prior to 5.127.4

Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. This is possible when the Administrator is logged in and a reflected attack may execute upon a click on a malicious URL. The components affected are inc/cleantalk-users.php and inc/cleantalk-comments.php.

Recommendations For versions prior to 5.127.4, update to version 5.127.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the inc/cleantalk-users.php and inc/cleantalk-comments.php components to minimize the risk of exploitation. Avoid using the from or till parameter in affected URLs until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17515

Affected Products

Cleantalk-Spam-Protect

References · 5

• https://osv.dev/vulnerability/CVE-2019-17515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17515 · Security Note
• https://plugins.trac.wordpress.org/changeset/2172333 · Patch
• https://wpvulndb.com/vulnerabilities/9949 · Note
• https://wordpress.org/plugins/cleantalk-spam-protect/#developers · Note