Lucene search

[email protected]CVE-2013-2107

HistoryMay 23, 2014 - 12:55 a.m.

CVE-2013-2107

2014-05-2300:55:03

CWE-352

[email protected]

web.nvd.nist.gov

cve-2013-2107

csrf

mail on update

wordpress

remote hijacking

authentication

plugin vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.8%

JSON

Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the “List of alternative recipients” via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.

Affected configurations

NVD

Node

mail_on_update_projectmail_on_updateRange≤5.1.0wordpress

mail_on_update_projectmail_on_updateMatch5.0.0wordpress

CPENameOperatorVersion
mail_on_update_project:mail_on_updatemail on update project mail on updatele5.1.0
mail_on_update_project:mail_on_updatemail on update project mail on updateeq5.0.0

CPE	Name	Operator	Version
mail_on_update_project:mail_on_update	mail on update project mail on update	le	5.1.0
mail_on_update_project:mail_on_update	mail on update project mail on update	eq	5.0.0

References

osvdb.org/93452

seclists.org/oss-sec/2013/q2/356

secunia.com/advisories/53449

wordpress.org/plugins/mail-on-update/changelog

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.8%

JSON

Related for CVE-2013-2107

wpvulndb1 prion1 cvelist1 nvd1