CVE-2015-9425

Опубликовано: 26 сент. 2019

Источник: nvd

CVSS3: 5.4

CVSS2: 4.3

EPSS Низкий

Описание

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.

Ссылки

http://cinu.pl/research/wp-plugins/mail_9e26c6f71bf8467e4a5017b15d5acddc.html
Exploit
Third Party Advisory
https://wordpress.org/plugins/social-locker/#developers
Product
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8327
Exploit
Third Party Advisory
http://cinu.pl/research/wp-plugins/mail_9e26c6f71bf8467e4a5017b15d5acddc.html
Exploit
Third Party Advisory
https://wordpress.org/plugins/social-locker/#developers
Product
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8327
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:byonepress:social_locker:*:*:*:*:*:wordpress:*:*

Версия до 4.2.5 (исключая)

EPSS

Процентиль: 34%

0.00137

Низкий

5.4 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-cpqx-84j9-wmpg

github

больше 3 лет назад