3.5
CVE-2012-4422
- EPSS 1.68%
- Veröffentlicht 14.09.2012 19:55:01
- Zuletzt bearbeitet 16.06.2026 23:44:59
- Erkennungen
LoginWordPress Core < 3.4.2 - Missing Authorization Checks
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
Mögliche Gegenmaßnahme
WordPress: Update to version 3.4.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt
WordPress
Version
*-3.4.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.68% | 0.738 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
http://codex.wordpress.org/Version_3.4.2
http://openwall.com/lists/oss-security/2012/09/13/4
http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file42
https://www.wordfence.com/threat-intel/vulnerabilities/id/342370a0-9364-40cd-9556-e53312e67548