CVE-2018-17884

Опубликовано: 02 окт. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php

Ссылки

http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdf
Exploit
Third Party Advisory
https://seclists.org/bugtraq/2018/Jul/74
Exploit
Mailing List
Third Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developers
Third Party Advisory
http://www.defensecode.com/advisories/DC-2018-05-008_WordPress_Gwolle_Guestbook_Plugin_Advisory.pdf
Exploit
Third Party Advisory
https://seclists.org/bugtraq/2018/Jul/74
Exploit
Mailing List
Third Party Advisory
https://wordpress.org/plugins/gwolle-gb/#developers
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gwolle_guestbook_project:gwolle_guestbook:*:*:*:*:*:wordpress:*:*

Версия до 2.5.4 (исключая)

EPSS

Процентиль: 48%

0.00254

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-mwpv-5q87-w5qr