Описание
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.3.2 (исключая)
cpe:2.3:a:rich-web:tab:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 75%
0.00898
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-862
CWE-425
Связанные уязвимости
CVSS3: 7.5
github
около 4 лет назад
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
EPSS
Процентиль: 75%
0.00898
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-862
CWE-425