PT-2014-8982

CVE-2014-9391

·

Publicado

2014-12-31

·

Atualizado

2015-01-03

Descrição por

CVSS 2.0
6.8
Média
MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions gSlideShow plugin versions 0.1 and earlier for WordPress
Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the rss, display time, or transistion time parameter in the "gslideshow.php" page to "wp-admin/options-general.php".
Recommendations For gSlideShow plugin versions 0.1 and earlier, consider disabling the gslideshow.php page or restricting access to the rss, display time, and transistion time parameters until a patch is available. Avoid using these parameters in the affected page to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-352: Cross-Site Request Forgery (CSRF)
Identificadores relacionados
CVE-2014-9391
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com