cnvd - cnvd-2015-00261

CNVD-2015-00261

Vulnerability from cnvd - Published: 2015-01-13

Title

WordPress插件Sliding Social Icons存在多个跨站请求伪造漏洞

Description

WordPress是一种使用PHP语言开发的博客平台,用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。Sliding Social Icons plugin是一款可对社交图标创建滑动效果的插件。 WordPress插件Sliding Social Icons存在多个跨站请求伪造漏洞，允许远程攻击者劫持administrars更改插件设置未明的vec请求身份验证，通过未明向量或进行跨站点脚本攻击。

Severity

中

Formal description

目前没有详细的解决方案，请到厂商的主页下载： http://www.wordpress.org

Reference

http://packetstormsecurity.com/files/129509 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9437

Impacted products

Name
WordPress Sliding Social Icons Plugin 1.61

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-9437"
    }
  },
  "description": "WordPress\u662f\u4e00\u79cd\u4f7f\u7528PHP\u8bed\u8a00\u5f00\u53d1\u7684\u535a\u5ba2\u5e73\u53f0,\u7528\u6237\u53ef\u4ee5\u5728\u652f\u6301PHP\u548cMySQL\u6570\u636e\u5e93\u7684\u670d\u52a1\u5668\u4e0a\u67b6\u8bbe\u81ea\u5df1\u7684\u7f51\u5fd7\u3002Sliding Social Icons plugin\u662f\u4e00\u6b3e\u53ef\u5bf9\u793e\u4ea4\u56fe\u6807\u521b\u5efa\u6ed1\u52a8\u6548\u679c\u7684\u63d2\u4ef6\u3002\r\n\r\nWordPress\u63d2\u4ef6Sliding Social Icons\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u52ab\u6301administrars\u66f4\u6539\u63d2\u4ef6\u8bbe\u7f6e\u672a\u660e\u7684vec\u8bf7\u6c42\u8eab\u4efd\u9a8c\u8bc1\uff0c\u901a\u8fc7\u672a\u660e\u5411\u91cf\u6216\u8fdb\u884c\u8de8\u7ad9\u70b9\u811a\u672c\u653b\u51fb\u3002",
  "discovererName": "WordPress",
  "formalWay": "\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\u00a0\r\nhttp://www.wordpress.org",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-00261",
  "openTime": "2015-01-13",
  "products": {
    "product": "WordPress Sliding Social Icons Plugin 1.61"
  },
  "referenceLink": "http://packetstormsecurity.com/files/129509\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9437",
  "serverity": "\u4e2d",
  "submitTime": "2015-01-08",
  "title": "WordPress\u63d2\u4ef6Sliding Social Icons\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2014-9437 (GCVE-0-2014-9437)

Vulnerability from cvelistv5 – Published: 2015-01-02 19:00 – Updated: 2024-08-06 13:47

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://packetstormsecurity.com/files/129509	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:47:40.353Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "slidingsocial-wp-scsocialslidermarg-csrf(99510)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99510"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/129509"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-07T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "slidingsocial-wp-scsocialslidermarg-csrf(99510)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99510"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/129509"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9437",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "slidingsocial-wp-scsocialslidermarg-csrf(99510)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99510"
            },
            {
              "name": "http://packetstormsecurity.com/files/129509",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/129509"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9437",
    "datePublished": "2015-01-02T19:00:00",
    "dateReserved": "2015-01-02T00:00:00",
    "dateUpdated": "2024-08-06T13:47:40.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-00261

CVE-2014-9437 (GCVE-0-2014-9437)

Tags

Sightings

Nomenclature