PT-2020-18505 · Merv Barrett · Easy Property Listings

Rei Nakahara · Published 2020-02-18 · Updated 2020-02-19 · CVE-2020-5530

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Property Listings versions prior to 3.4

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. The attack vector is not specified.

Recommendations For versions prior to 3.4, update to version 3.4 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication checks to minimize the risk of exploitation. Restrict access to administrative functions to minimize the risk of CSRF attacks until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-5530

Affected Products

Easy Property Listings

References · 5

• https://osv.dev/vulnerability/CVE-2020-5530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5530 · Security Note
• https://wordpress.org/plugins/easy-property-listings/#developers · Note
• https://wpvulndb.com/vulnerabilities/10075 · Note
• https://jvn.jp/en/jp/JVN89259622/index.html · Note