Lucene search

MitreCVE-2015-2084

HistoryFeb 25, 2015 - 10:59 p.m.

CVE-2015-2084

2015-02-2522:59:04

CWE-352

mitre

web.nvd.nist.gov

cve

2015

2084

csrf

vulnerability

easy social icons

plugin

wordpress

xss

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.006

Percentile

77.6%

JSON

Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.

Affected configurations

Nvd

Node

cybernetikzeasy_social_iconsRange≤1.2.2wordpress

VendorProductVersionCPE
cybernetikzeasy_social_icons*cpe:2.3:a:cybernetikz:easy_social_icons:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
cybernetikz	easy_social_icons	*	cpe:2.3:a:cybernetikz:easy_social_icons::::::wordpress::*

References

packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html

seclists.org/fulldisclosure/2015/Feb/76

www.exploit-db.com/exploits/36161

www.securityfocus.com/bid/74893

wordpress.org/plugins/easy-social-icons/changelog/

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.006

Percentile

77.6%

JSON

Related for CVE-2015-2084