CVE-2019-13275

Опубликовано: 04 июл. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.

Ссылки

https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75
Patch
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developers
Product
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9412
Exploit
Third Party Advisory
https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75
Patch
Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developers
Product
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9412
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*

Версия до 12.6.6 (включая)

EPSS

Процентиль: 79%

0.01256

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-8ff5-r74w-ww6j