CVE-2013-2700

Опубликовано: 14 мая 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.

Ссылки

http://osvdb.org/92113
http://secunia.com/advisories/52876
Vendor Advisory
http://wordpress.org/plugins/wp125/changelog
https://plugins.trac.wordpress.org/changeset/692721
Exploit
Patch
http://osvdb.org/92113
http://secunia.com/advisories/52876
Vendor Advisory
http://wordpress.org/plugins/wp125/changelog
https://plugins.trac.wordpress.org/changeset/692721
Exploit
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:webmaster-source:wp125:*:*:*:*:*:wordpress:*:*

Версия до 1.4.9 (включая)

cpe:2.3:a:webmaster-source:wp125:1.0.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.1.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.2.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.3.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.3.7:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.3.8:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.3.9:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.1:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.2:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.3:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.4:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.5:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.6:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.7:*:*:*:*:wordpress:*:*

cpe:2.3:a:webmaster-source:wp125:1.4.8:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 48%

0.00251

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-j27r-gmgx-jgq3

github

больше 3 лет назад