Описание
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
Ссылки
- ExploitThird Party Advisory
- https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-in-wp-maintenance-plugin/ExploitThird Party Advisory
- ExploitThird Party Advisory
- https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-in-wp-maintenance-plugin/ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 5.0.6 (исключая)
cpe:2.3:a:wp_maintenance_project:wp_maintenance:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 42%
0.00196
Низкий
8.8 High
CVSS3
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
больше 3 лет назад
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
EPSS
Процентиль: 42%
0.00196
Низкий
8.8 High
CVSS3
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-79