4.3

CVE-2015-3439

Exploit

WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Mögliche Gegenmaßnahme
WordPress: Update to one of the following versions, or a newer patched version: 3.7.6, 3.8.6, 3.9.4, 4.0.2, 4.1.2
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Wordpress ≫ Wordpress Version3.9.0
Wordpress ≫ Wordpress Version3.9.1
Wordpress ≫ Wordpress Version3.9.2
Wordpress ≫ Wordpress Version3.9.3
Wordpress ≫ Wordpress Version4.0
Wordpress ≫ Wordpress Version4.0.1
Wordpress ≫ Wordpress Version4.1
Wordpress ≫ Wordpress Version4.1.1
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version [*, 3.7)
Version 3.7-3.7.5
Version 3.8-3.8.5
Version 3.9-3.9.3
Version 4.0-4.0.1
Version 4.1-4.1.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.04% 0.924
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html
http://www.debian.org/security/2015/dsa-3250
http://codex.wordpress.org/Version_4.1.2
Patch
Exploit
http://www.securityfocus.com/bid/74269
http://www.securitytracker.com/id/1032207
https://wordpress.org/news/2015/04/wordpress-4-1-2/
Vendor Advisory
Exploit
http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html
Exploit
https://core.trac.wordpress.org/changeset/32168
https://wpvulndb.com/vulnerabilities/7933
https://www.wordfence.com/threat-intel/vulnerabilities/id/6346024c-61d5-4f73-b7f2-3a8fd3fb838e
Third Party Advisory