6.8

CVE-2013-5977

Exploit

Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting (XSS) attacks via the (2) Product name or (3) Price description field in a product save action via a request to wp-admin/admin.php.
Mögliche Gegenmaßnahme
Cart66 Lite :: WordPress Ecommerce: Update to version 1.5.1.15, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Cart66 Lite :: WordPress Ecommerce
Version [*, 1.5.1.15)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cart66 ≫ Cart66 Lite Plugin Update- SwPlatformwordpress Version <= 1.5.1.14
Cart66 ≫ Cart66 Lite Plugin Version1.0.7 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.0.8 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.3 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.4 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.5 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.1.6 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.3.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.4 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.7 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.8 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.4.9 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.0.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.1 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.2 Update- SwPlatformwordpress
Cart66 ≫ Cart66 Lite Plugin Version1.5.1.8 Update- SwPlatformwordpress
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.68
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.