CVE-2013-1407

Опубликовано: 13 мая 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.

Ссылки

http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html
Exploit
Patch
http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update
Patch
Vendor Advisory
https://www.htbridge.com/advisory/HTB23139
Exploit
Patch
http://archives.neohapsis.com/archives/bugtraq/2013-03/0034.html
Exploit
Patch
http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update
Patch
Vendor Advisory
https://www.htbridge.com/advisory/HTB23139
Exploit
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:netweblogic:events_manager:*:-:-:*:-:wordpress:*:*

Версия до 5.3.4 (включая)

cpe:2.3:a:netweblogic:events_manager:5.3:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager:5.3.1:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager:5.3.2:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager:5.3.2.1:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager:5.3.3:-:-:*:-:wordpress:*:*

Конфигурация 2

Одно из

cpe:2.3:a:netweblogic:events_manager_pro:*:-:-:*:-:wordpress:*:*

Версия до 2.2.7 (включая)

cpe:2.3:a:netweblogic:events_manager_pro:2.2:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.1:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.2:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.3:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.4:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.5:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.6:-:-:*:-:wordpress:*:*

cpe:2.3:a:netweblogic:events_manager_pro:2.2.8:-:-:*:-:wordpress:*:*

EPSS

Процентиль: 53%

0.00306

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c85v-28hm-3hmj

github

больше 3 лет назад