CVE-2013-3264

Опубликовано: 05 нояб. 2013

Источник: nvd

CVSS2: 6.4

EPSS Низкий

Описание

The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data.

Ссылки

http://secunia.com/advisories/53170
Vendor Advisory
http://www.securityfocus.com/bid/62621
http://secunia.com/advisories/53170
Vendor Advisory
http://www.securityfocus.com/bid/62621

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:*:-:*:*:*:wordpress:*:*

Версия до 1.1.0 (включая)

cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.0:-:*:*:*:wordpress:*:*

cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.1:-:*:*:*:wordpress:*:*

cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.2:-:*:*:*:wordpress:*:*

cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.3:-:*:*:*:wordpress:*:*

EPSS

Процентиль: 71%

0.00674

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-pvp3-cmc4-qpm7

github

больше 3 лет назад