CVE-2015-0895

2015-03-0702:59:02

CWE-352

[email protected]

web.nvd.nist.gov

cve-2015-0895

cross-site request forgery

csrf vulnerability

all in one wp security & firewall

wordpress

authentication hijacking

404 logs deletion

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

52.3%

JSON

Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.

Affected configurations

NVD

Node

tips_and_tricks_hqall_in_one_wordpress_security_and_firewallRange≤3.8.9wordpress

CPENameOperatorVersion
tips_and_tricks_hq:all_in_one_wordpress_security_and_firewalltips and tricks hq all in one wordpress security and firewallle3.8.9