Lucene search
HistoryMay 23, 2014 - 2:55 p.m.
CVE-2014-3849
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.8 Medium
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.5%
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.
Affected configurations
Node
imember360imember360Match3.8.012wordpress
ORimember360imember360Match3.8.013wordpress
ORimember360imember360Match3.8.014wordpress
ORimember360imember360Match3.9.000wordpress
ORimember360imember360Match3.9.001wordpress
Related
prion
prion
Design/Logic Flaw
2014-05-23 14:55:00
cve
cve
CVE-2014-3849
2022-10-03 16:20:25
patchstack
patchstack
WordPress iMember360 Plugin <= 3.9.001 - Arbitrary user deletion
2014-05-23 00:00:00
cvelist
cvelist
CVE-2014-3849
2022-10-03 16:20:25
wpvulndb
wpvulndb
iMember360 < 3.9.001 - Multiple Issues
2014-04-24 00:00:00
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.8 Medium
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.5%
Related for NVD:CVE-2014-3849