PT-2014-8982
CVE-2014-9391
·
تاريخ النشر
2014-12-31
·
تاريخ التحديث
2015-01-03
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
gSlideShow plugin versions 0.1 and earlier for WordPress
Description
The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the
rss, display time, or transistion time parameter in the "gslideshow.php" page to "wp-admin/options-general.php".Recommendations
For gSlideShow plugin versions 0.1 and earlier, consider disabling the gslideshow.php page or restricting access to the rss, display time, and transistion time parameters until a patch is available. Avoid using these parameters in the affected page to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾