6.8
CVE-2014-8948
- EPSS 0.96%
- Veröffentlicht 16.11.2014 11:59:04
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginiMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.
Mögliche Gegenmaßnahme
iMember360is: Update to version 3.9.001, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
iMember360is
Version
[3.8.012, 3.9.001)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Imember360 ≫ Imember360 Version3.8.012 SwPlatformwordpress
Imember360 ≫ Imember360 Version3.8.013 SwPlatformwordpress
Imember360 ≫ Imember360 Version3.8.014 SwPlatformwordpress
Imember360 ≫ Imember360 Version3.9.000 SwPlatformwordpress
Imember360 ≫ Imember360 Version3.9.001 SwPlatformwordpress
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.96% | 0.746 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.