CVE-2017-15863

Опубликовано: 24 окт. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.

Ссылки

http://lists.openwall.net/full-disclosure/2017/06/02/3
Exploit
Mailing List
Third Party Advisory
VDB Entry
https://wordpress.org/plugins/wp-noexternallinks/#developers
Release Notes
Third Party Advisory
http://lists.openwall.net/full-disclosure/2017/06/02/3
Exploit
Mailing List
Third Party Advisory
VDB Entry
https://wordpress.org/plugins/wp-noexternallinks/#developers
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wp_no_external_links_project:wp_no_external_links:*:*:*:*:*:wordpress:*:*

Версия до 3.5.18 (включая)

EPSS

Процентиль: 41%

0.00193

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-v626-c9xh-rhf4