CVE-2014-5347

Опубликовано: 19 авг. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:disqus:disqus_comment_system:*:*:*:*:*:wordpress:*:*

Версия до 2.75 (включая)

cpe:2.3:a:disqus:disqus_comment_system:2.40:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.41:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.42:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.43:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.44:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.45:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.46:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.47:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.48:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.49:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.50:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.51:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.52:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.53:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.54:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.55:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.60:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.61:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.62:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.63:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.64:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.65:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.66:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.67:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.68:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.69:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.70:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.71:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.72:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.73:*:*:*:*:wordpress:*:*

cpe:2.3:a:disqus:disqus_comment_system:2.74:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 87%

0.03145

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-gq77-h4w4-h7hf

github

больше 3 лет назад