CVE-2013-6797

2022-10-0316:14:52

CWE-352

[email protected]

web.nvd.nist.gov

cve-2013-6797

csrf

vulnerability

blue wrench video widget

wordpress

hijack

authentication

administrators

remote attackers

bw_url parameter

wp-admin/admin.php

javascript

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.2%

JSON

Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter in the bw-videos page to wp-admin/admin.php, as demonstrated by embedding a URL to a JavaScript file.

Affected configurations

NVD

Node

sunil_nandablue_wrench_video_widgetRange≤1.0.5-wordpress

sunil_nandablue_wrench_video_widgetMatch1.0.0-wordpress

sunil_nandablue_wrench_video_widgetMatch1.0.1-wordpress

sunil_nandablue_wrench_video_widgetMatch1.0.2-wordpress

sunil_nandablue_wrench_video_widgetMatch1.0.3-wordpress

sunil_nandablue_wrench_video_widgetMatch1.0.4-wordpress

CPENameOperatorVersion
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgetle1.0.5
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgeteq1.0.0
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgeteq1.0.1
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgeteq1.0.2
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgeteq1.0.3
sunil_nanda:blue_wrench_video_widgetsunil nanda blue wrench video widgeteq1.0.4

CPE	Name	Operator	Version
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	le	1.0.5
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	eq	1.0.0
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	eq	1.0.1
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	eq	1.0.2
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	eq	1.0.3
sunil_nanda:blue_wrench_video_widget	sunil nanda blue wrench video widget	eq	1.0.4