PT-2023-10273 · Fastly · Fastly Plugin

Zack Tollman · Published 2023-03-06 · Updated 2024-05-17 · CVE-2015-10094

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fastly Plugin versions up to 0.97

Description A vulnerability was found in the Fastly Plugin, which has been rated as problematic. The issue affects the function post of the file lib/api.php. The manipulation of the url argument leads to cross-site scripting. The attack may be launched remotely.

Recommendations To address this issue, upgrade to version 0.98. As a temporary workaround, consider restricting the use of the post function in the lib/api.php file until the update is applied. Additionally, avoid using the url argument in the affected function to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10094

Affected Products

Fastly Plugin

References · 8

• https://github.com/wp-plugins/fastly/releases/tag/0.98 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10094 · Security Note
• https://github.com/wp-plugins/fastly/commit/d7fe42538f4d4af500e3af9678b6b06fba731656 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10094 · Note
• https://vuldb.com/?id.222326 · Note
• https://vuldb.com/?ctiid.222326 · Note
• https://t.me/cvenotify/64316 · Telegram Post
• https://t.me/cibsecurity/59488 · Telegram Post