PT-2024-10564 · Unknown · Chrisy Tfo Graphviz Plugin

Chrisy · Published 2024-03-31 · Updated 2024-05-17 · CVE-2015-10131

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions chrisy TFO Graphviz Plugin versions up to 1.9

Description A vulnerability was found in the chrisy TFO Graphviz Plugin, which is classified as problematic. The issue affects the function admin page load/admin page of the file tfo-graphviz-admin.php, leading to cross-site scripting. The attack can be launched remotely.

Recommendations For chrisy TFO Graphviz Plugin versions up to 1.9, upgrade to version 1.10 to address this issue. As a temporary workaround, consider disabling the admin page load/admin page function in the tfo-graphviz-admin.php file until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-10131

Affected Products

Chrisy Tfo Graphviz Plugin

References · 6

• https://github.com/wp-plugins/tfo-graphviz/releases/tag/1.10 · Patch
• https://github.com/wp-plugins/tfo-graphviz/commit/594c953a345f79e26003772093b0caafc14b92c2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10131 · Security Note
• https://t.me/cvenotify/75233 · Telegram Post
• https://vuldb.com/?ctiid.258620 · Note
• https://vuldb.com/?id.258620 · Note