4.3

CVE-2012-4273

Exploit

2 Click Social Media Buttons < 0.34 - Cross-Site Scripting

Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
Mögliche Gegenmaßnahme
2 Click Social Media Buttons: Update to version 0.34, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ppfeufer ≫ 2-click-social-media-buttons Version <= 0.33
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.1 Update -
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.2
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.3
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.10
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.11
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.11 Update r1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.11 Update r2
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.12
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.13
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.14
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.15
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.16
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.17
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.18
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.18.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.19
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.19.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.20
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.21
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.21.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.22
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.23
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.23.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.24
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.24.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.25
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.26
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.27
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.27.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.28
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.29
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.30
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.31.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.31.2
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.31.3
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.32.1
   Wordpress ≫ Wordpress Version -
Ppfeufer ≫ 2-click-social-media-buttons Version 0.32.2
   Wordpress ≫ Wordpress Version -
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt 2 Click Social Media Buttons
Version [*, 0.34)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.78% 0.921
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798
Patch
Exploit
http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/
http://packetstormsecurity.org/files/112615/WordPress-2-Click-Socialmedia-Buttons-Cross-Site-Scripting.html
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/75518
https://www.wordfence.com/threat-intel/vulnerabilities/id/82da75f4-f036-40e0-ae4c-5011d6a39df4
Third Party Advisory