CVE-2013-6797

Опубликовано: 19 нояб. 2013

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php, as demonstrated by embedding a URL to a JavaScript file.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:*:-:*:*:*:wordpress:*:*

Версия до 1.0.5 (включая)

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:1.0.0:-:*:*:*:wordpress:*:*

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:1.0.1:-:*:*:*:wordpress:*:*

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:1.0.2:-:*:*:*:wordpress:*:*

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:1.0.3:-:*:*:*:wordpress:*:*

cpe:2.3:a:sunil_nanda:blue_wrench_video_widget:1.0.4:-:*:*:*:wordpress:*:*

EPSS

Процентиль: 50%

0.0027

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-mw8f-qp6v-5695

github

больше 3 лет назад