Lucene search

MitreCVE-2015-5483

HistoryJan 28, 2020 - 8:15 p.m.

CVE-2015-5483

2020-01-2820:15:12

CWE-352

mitre

web.nvd.nist.gov

cve-2015-5483

csrf

wordpress

remote attackers

authentication

administrators

cross-site scripting

xss

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.

Affected configurations

Nvd

Node

private_only_projectprivate_onlyMatch3.5.1wordpress

VendorProductVersionCPE
private_only_projectprivate_only3.5.1cpe:2.3:a:private_only_project:private_only:3.5.1:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
private_only_project	private_only	3.5.1	cpe:2.3:a:private_only_project:private_only:3.5.1:::::wordpress::

References

packetstormsecurity.com/files/133349/WordPress-Private-Only-3.5.1-CSRF-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2015/Aug/77

security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

Related for CVE-2015-5483