CVE-2013-2107

Опубликовано: 23 мая 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.

Ссылки

http://osvdb.org/93452
http://seclists.org/oss-sec/2013/q2/356
Exploit
http://secunia.com/advisories/53449
http://wordpress.org/plugins/mail-on-update/changelog
Patch
Vendor Advisory
http://osvdb.org/93452
http://seclists.org/oss-sec/2013/q2/356
Exploit
http://secunia.com/advisories/53449
http://wordpress.org/plugins/mail-on-update/changelog
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mail_on_update_project:mail_on_update:*:*:*:*:*:wordpress:*:*

Версия до 5.1.0 (включая)

cpe:2.3:a:mail_on_update_project:mail_on_update:5.0.0:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 72%

0.00699

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-wc3q-ccmv-3p9w

github

больше 3 лет назад