{"reporter": "NVD", "enchantments": {"score": {"vector": "NONE", "value": 4.3}, "vulnersScore": 4.3}, "published": "2015-09-21T15:59:01", "cvelist": ["CVE-2015-6238"], "title": "CVE-2015-6238", "objectVersion": "1.2", "type": "cve", "hash": "c241e5ce75c92dbb0dbc59c4713dbb40f41df8622a8c6f3fff54cdf77f428f84", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6238", "bulletinFamily": "NVD", "id": "CVE-2015-6238", "history": [], "scanner": [], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "modified": "2015-09-23T15:12:56", "viewCount": 2, "cpe": ["cpe:/a:sumome:google_analyticator:6.4.9.5::~~~wordpress~~"], "edition": 1, "description": "Multiple cross-site scripting (XSS) vulnerabilities in the Google Analyticator plugin before 6.4.9.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) ga_adsense, (2) ga_admin_disable_DimentionIndex, (3) ga_downloads_prefix, (4) ga_downloads, or (5) ga_outbound_prefix parameter in the google-analyticator page to wp-admin/admin.php.", "references": ["https://wordpress.org/plugins/google-analyticator/changelog/", "https://wpvulndb.com/vulnerabilities/8159", "https://www.netsparker.com/cve-2015-6238-multiple-xss-vulnerabilities-in-google-analyticator/"], "lastseen": "2016-09-03T23:02:38", "assessment": {"system": "", "name": "", "href": ""}}

{"packetstorm": [{"lastseen": "2016-12-05T22:25:02", "references": [], "edition": 1, "description": "", "reporter": "Omar Kurt", "published": "2015-08-25T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 4.3}}, "type": "packetstorm", "title": "Google Analyticator 6.4.9.4 Cross Site Scripting", "bulletinFamily": "exploit", "cvelist": ["CVE-2015-6238"], "modified": "2015-08-25T00:00:00", "href": "https://packetstormsecurity.com/files/133301/Google-Analyticator-6.4.9.4-Cross-Site-Scripting.html", "id": "PACKETSTORM:133301", "sourceData": "`Information \n-------------------- \nAdvisory by Netsparker. \nName: Multiple XSS Vulnerabilities in Google Analyticator \nAffected Software : Google Analyticator (WordPress Plugin) \nAffected Versions: 6.4.9.4 and possibly below \nVendor Homepage : https://wordpress.org/plugins/google-analyticator/ \nVulnerability Type : Cross-site Scripting \nSeverity : Important \nStatus : Fixed \nCVE-ID : CVE-2015-6238 \nNetsparker Advisory Reference : NS-15-013 \n \nDescription \n-------------------- \nBy exploiting a Cross-site scripting vulnerability the attacker can hijack \na logged in user\u2019s session. This means that the malicious hacker can change \nthe logged in user\u2019s password and invalidate the session of the victim \nwhile the hacker maintains access. As seen from the XSS example in this \narticle, if a web application is vulnerable to cross-site scripting and the \nadministrator\u2019s session is hijacked, the malicious hacker exploiting the \nvulnerability will have full admin privileges on that web application. \n \nTechnical Details \n-------------------- \nProof of Concept URLs for XSS in Google Analyticator 6.4.9.4: \n \nUrl http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator \nParameter Name ga_adsense \nParameter Type POST \nAttack Pattern x'\" onmouseover=alert(9) \n \nUrl http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator \nParameter Name ga_admin_disable_DimentionIndex \nParameter Type POST \nAttack Pattern x'\" onmouseover=alert(9) \n \nUrl http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator \nParameter Name ga_downloads_prefix \nParameter Type POST \nAttack Pattern x'\" onmouseover=alert(9) \n \nUrl http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator \nParameter Name ga_downloads \nParameter Type POST \nAttack Pattern x'\" onmouseover=alert(9) \n \nUrl http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator \nParameter Name ga_outbound_prefix \nParameter Type POST \nAttack Pattern x'\" onmouseover=alert(9) \n \nFor more information on cross-site scripting vulnerabilities read the \nfollowing article: \nhttps://www.netsparker.com/web-vulnerability-scanner/vulnerability-security-checks-index/crosssite-scripting-xss/ \n \nAdvisory Timeline \n-------------------- \n14/08/2015 - First Contact \n24/08/2015 - Vendor Fixed \n24/08/2015 - Advisory Released \n \nSolution \n-------------------- \nhttps://downloads.wordpress.org/plugin/google-analyticator.6.4.9.6.zip \n \nCredits & Authors \n-------------------- \nThese issues have been discovered by Omar Kurt while testing Netsparker Web \nApplication Security Scanner. \n \nAbout Netsparker \n-------------------- \nNetsparker finds and reports security issues and vulnerabilities such as \nSQL Injection and Cross-site Scripting (XSS) in all websites and web \napplications regardless of the platform and the technology they are built \non. Netsparker's unique detection and exploitation techniques allows it to \nbe dead accurate in reporting hence it's the first and the only False \nPositive Free web application security scanner. For more information visit \nour website on https://www.netsparker.com \n \n-- \nOnur Y\u0131lmaz - National General Manager \n \nNetsparker Web Application Security Scanner <https://www.netsparker.com> \nT: +90 (0)554 873 0482 \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/133301/NS-15-013.txt", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "wpvulndb": [{"lastseen": "2018-09-17T19:25:30", "_object_types": ["robots.models.wpvulndb.WPVulnDBBulletin", "robots.models.base.Bulletin"], "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6238", "http://packetstormsecurity.com/files/133301/", "https://www.netsparker.com/cve-2015-6238-multiple-xss-vulnerabilities-in-google-analyticator/"], "description": "WordPress Vulnerability - Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS)\n", "reporter": "ethicalhack3r", "published": "2015-08-24T00:00:00", "type": "wpvulndb", "title": "Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS)", "enchantments": {"score": {"modified": "2018-09-17T19:25:30", "vector": "NONE", "value": 4.3}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "google-analyticator", "version": "6.4.9.6", "operator": "lt"}], "cvelist": ["CVE-2015-6238"], "_object_type": "robots.models.wpvulndb.WPVulnDBBulletin", "modified": "2015-09-23T00:00:00", "id": "WPVDB-ID:8159", "href": "https://wpvulndb.com/vulnerabilities/8159", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}