Lucene search

Japan Vulnerability NotesJVN:14567604

HistoryOct 20, 2016 - 12:00 a.m.

JVN#14567604: Multiple vulnerabilities in WordPress plugin WP-OliveCart

2016-10-2000:00:00

Japan Vulnerability Notes

jvn.jp

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

62.0%

JSON

WP-OliveCart provided by Olive Design is a WordPress plugin to construct a shopping site. WP-OliveCart contains the following vulnerabilities.

Cross-site scripting (CWE-79) - CVE-2016-4903

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Base Score: 6.1
CVSS v2	AV:N/AC:M/Au:N/C:N/I:P/A:N	Base Score: 4.3

Cross-site request forgery (CWE-352) - CVE-2016-4904

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

SQL Injection (CWE-89) - CVE-2016-4905

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	Base Score: 4.7
CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Impact

Effects vary depending on the vulnerability, the following is a list of the effects of each:

An arbitrary script may be executed on user’s web browser - CVE-2016-4903
Unintended operations may be conducted when a user views a malicious page while logged in - CVE-2016-4904
Information stored in the database may be obtained or altered - CVE-2016-4905

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

WP-OliveCart versions prior to 3.1.3
WP-OliveCartPro versions prior to 3.1.8

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

62.0%

JSON

Related for JVN:14567604