PT-2019-15200 · Blog2Social · Blog2Social

Published 2019-11-13 · Updated 2019-11-18 · CVE-2019-17550

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.9.0

Description The issue allows an attacker to execute arbitrary HTML and JavaScript code via the b2s id parameter. This occurs in the views/b2s/post.calendar.php component when the Administrator is logged in, and a reflected attack may execute upon a click on a malicious URL.

Recommendations For versions prior to 5.9.0, update to version 5.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the views/b2s/post.calendar.php component and avoiding use of the b2s id parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17550

Affected Products

Blog2Social

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-17550 · Security Note
• https://plugins.trac.wordpress.org/changeset/2186043 · Patch
• https://osv.dev/vulnerability/CVE-2019-17550 · Vendor Advisory
• https://wordpress.org/plugins/blog2social/#developers · Note
• https://plugins.trac.wordpress.org/log/blog2social · Note
• https://wpvulndb.com/vulnerabilities/9948 · Note