6.8

CVE-2014-8948

Exploit

iMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery

Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.
Mögliche Gegenmaßnahme
iMember360is: Update to version 3.9.001, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Imember360 ≫ Imember360 Version 3.8.012 SwPlatform wordpress
Imember360 ≫ Imember360 Version 3.8.013 SwPlatform wordpress
Imember360 ≫ Imember360 Version 3.8.014 SwPlatform wordpress
Imember360 ≫ Imember360 Version 3.9.000 SwPlatform wordpress
Imember360 ≫ Imember360 Version 3.9.001 SwPlatform wordpress
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt iMember360is
Version [3.8.012, 3.9.001)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.72% 0.884
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html
Exploit
http://seclists.org/fulldisclosure/2014/Apr/265
Exploit
http://secunia.com/advisories/58094
http://www.exploit-db.com/exploits/33076
Exploit
http://osvdb.org/show/osvdb/106301
https://www.wordfence.com/threat-intel/vulnerabilities/id/c1621cd2-78d3-4429-862a-b425f5436f38
Third Party Advisory