Описание
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.10.5 (исключая)
cpe:2.3:a:caseproof:thirstyaffiliates_affiliate_link_manager:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 21%
0.00066
Низкий
5.4 Medium
CVSS3
4.9 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 5.4
github
почти 4 года назад
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
EPSS
Процентиль: 21%
0.00066
Низкий
5.4 Medium
CVSS3
4.9 Medium
CVSS2
Дефекты
CWE-352