CVE-2017-15867

Опубликовано: 24 окт. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7) operating_system, or (8) ip_address parameter to admin/partials/listing/listing.php.

Ссылки

https://github.com/faiyazalam/WordPress-plugin-user-login-history/commit/519341a7dece59e2c589b908a636e6cf12a61741
Patch
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8939
Third Party Advisory
https://github.com/faiyazalam/WordPress-plugin-user-login-history/commit/519341a7dece59e2c589b908a636e6cf12a61741
Patch
Third Party Advisory
https://wpvulndb.com/vulnerabilities/8939
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:user-login-history_project:user-login-history:*:*:*:*:*:wordpress:*:*

Версия до 1.5.2 (включая)

EPSS

Процентиль: 50%

0.0027

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-jrm2-6mfg-m96p