CVE-2014-4030

Опубликовано: 25 июн. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:*:*:*:*:*:wordpress:*:*

Версия до 2.1.3 (включая)

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.1:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.2:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.3:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.4:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.0.5:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.1.0:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.1.1:*:*:*:*:wordpress:*:*

cpe:2.3:a:longtailvideo:jw_player_for_flash_\&_html5_video_plugin:2.1.2:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 58%

0.00371

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-67ph-qxrg-rr9v

github

больше 3 лет назад