[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20150125184713.GB24557@kludge.henri.nerv.fi>
Date: Sun, 25 Jan 2015 20:47:13 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: Hans-Martin Münch <muench@...waisecurity.de>
Subject: CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple
Vulnerabilities
Hi,
Can I get 2014 year CVEs for following vulnerabilities in WordPress plugin
pixabay-images, thanks.
Original advisory: http://seclists.org/bugtraq/2015/Jan/94
"""
1) Authentication bypass
The plugin does not correctly check if the user is logged in. Certain
code can be called without authentication
2) Arbitrary file upload
The plugin code does not validate the host in the provided download URL,
which allows to upload malicious files, including PHP code.
3) Path Traversal
Certain values are not sanitized before they are used in a file operation.
This allows to store files outside of the "download" folder.
4) Cross Site Scripting (XSS)
The generated author link uses unsanitized user values which can be
abused for Cross Site Scripting (XSS) attacks.
"""
Fixed in 2.4 version.
Listed in OSVDB as:
http://osvdb.org/117144 Pixabay Images Plugin for WordPress pixabay-images.php
image_user Parameter Reflected XSS
http://osvdb.org/117145 Pixabay Images Plugin for WordPress pixabay-images.php
Image Upload Handling Missing File Type Restrictions Remote Code Execution
http://osvdb.org/117146 Pixabay Images Plugin for WordPress pixabay-images.php
Image Upload Handling Authentication Bypass
http://osvdb.org/117147 Pixabay Images Plugin for WordPress pixabay-images.php
Image Upload Handling Path Traversal Issue
--
Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
