Lucene search

VulDBCVELIST:CVE-2014-125110

HistoryMar 31, 2024 - 11:31 p.m.

CVE-2014-125110 wp-file-upload Plugin wfu_ajaxactions.php wfu_ajax_action_callback cross site scripting

2024-03-3123:31:04

CWE-79

VulDB

www.cve.org

cross site scripting

wordpress

wfu_ajaxactions.php

remote attack

upgrade

c846327df030a0a97da036a2f07c769ab9284ddb

vdb-258781

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "wp-file-upload Plugin",
    "versions": [
      {
        "version": "2.4.0",
        "status": "affected"
      },
      {
        "version": "2.4.1",
        "status": "affected"
      },
      {
        "version": "2.4.2",
        "status": "affected"
      },
      {
        "version": "2.4.3",
        "status": "affected"
      }
    ]
  }
]

References

github.com/wp-plugins/wp-file-upload/commit/c846327df030a0a97da036a2f07c769ab9284ddb

github.com/wp-plugins/wp-file-upload/releases/tag/2.4.4

vuldb.com/?ctiid.258781

vuldb.com/?id.258781

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Related for CVELIST:CVE-2014-125110