Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2018-3810
HistoryJan 01, 2018 - 6:29 a.m.

CVE-2018-3810

2018-01-0106:29:00
CWE-287
[email protected]
web.nvd.nist.gov
1

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.773

Percentile

98.2%

JSON

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

Affected configurations

Nvd
Node
oturiasmart_google_code_inserterRange<3.5wordpress
VendorProductVersionCPE
oturiasmart_google_code_inserter*cpe:2.3:a:oturia:smart_google_code_inserter:*:*:*:*:*:wordpress:*:*

Related

prion 1
patchstack 2
cvelist 1
cve 1
wpvulndb 1
nuclei 1
zdt 1
exploitdb 1
exploitpack 1
packetstorm 1
openvas 1
prion
prion
Authentication flaw
2018-01-01 06:29:00
patchstack
patchstack
WordPress Smart Google Code Inserter plugin <= 3.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability
2018-01-08 00:00:00
WordPress Smart Google Code Inserter plugin <=3.4 - Authorization bypass vulnerability
2018-01-03 00:00:00
cvelist
cvelist
CVE-2018-3810
2018-01-01 06:00:00
cve
cve
CVE-2018-3810
2018-01-01 06:29:00
wpvulndb
wpvulndb
Smart Google Code Inserter <= 3.4 - Unauthenticated Cross-Site Scripting (XSS)
2018-01-01 00:00:00
nuclei
nuclei
Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass
2021-03-10 11:36:11
zdt
zdt
WordPress Smart Google Code Inserter Plugin < 3.5 - Authentication Bypass / SQL Injection
2018-01-03 00:00:00
exploitdb
exploitdb
WordPress Plugin Smart Google Code Inserter &lt; 3.5 - Authentication Bypass / SQL Injection
2018-01-03 00:00:00
exploitpack
exploitpack
WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection
2018-01-03 00:00:00
packetstorm
packetstorm
WordPress Smart Google Code Inserter SQL Injection
2018-01-03 00:00:00
openvas
openvas
WordPress Smart Google Code Inserter Plugin < 3.5 Multiple Vulnerabilities
2018-01-02 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.773

Percentile

98.2%

JSON
Related for NVD:CVE-2018-3810
prion1patchstack2cvelist1cve1wpvulndb1nuclei1zdt1exploitdb1exploitpack1packetstorm1openvas1