PT-2023-10171 · Bestwebsoft · Bestwebsoft Twitter Plugin

Published 2023-05-31 · Updated 2024-05-17 · CVE-2014-125103

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BestWebSoft Twitter Plugin versions up to 1.3.2

Description A vulnerability was found in the BestWebSoft Twitter Plugin. It affects the function twttr settings page of the file twitter.php. The manipulation of the argument twttr url twitter/bws license key/bws license plugin leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 1.3.7 is able to address this issue.

Recommendations For BestWebSoft Twitter Plugin versions up to 1.3.2, upgrade to version 1.3.7 to address the issue. As a temporary workaround, consider disabling the twttr settings page function until a patch is available. Restrict access to the twitter.php file to minimize the risk of exploitation. Avoid using the argument twttr url twitter/bws license key/bws license plugin in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-125103

Affected Products

Bestwebsoft Twitter Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-125103 · Security Note
• https://github.com/wp-plugins/twitter-plugin/commit/e04d59ab578316ffeb204cf32dc71c0d0e1ff77c · Patch
• https://vuldb.com/?id.230155 · Note
• https://t.me/cvenotify/60668 · Telegram Post
• https://vuldb.com/?ctiid.230155 · Note