[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20150413062510.A338D1BE0A6@smtpvbsrv1.mitre.org>
Date: Mon, 13 Apr 2015 02:25:10 -0400 (EDT)
From: cve-assign@...re.org
To: mattd@...fuzz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I'd like to request a CVE ID for this issue. This is the first such
> request; this message serves as an advisory as well.
>
> Affected software: Floating Social Bar (Wordpress plugin)
> Affected versions: 1.0.1 - 1.1.6
> Website: https://wordpress.org/plugins/floating-social-bar/
>
> Description: One of the plugin's unauthenticated AJAX action handlers
> is vulnerable to a stored cross-site scripting vulnerability. By
> invoking the action with certain parameters, it is possible for
> unauthenticated attackers to force the persistent injection of
> arbitrary script across the site's post pages.
>
> Fixed version: 1.1.7
> Fix: https://plugins.trac.wordpress.org/changeset/1129648/floating-social-bar/trunk
> Changelog: https://plugins.trac.wordpress.org/changeset/1129648/floating-social-bar/trunk#file5
Use CVE-2015-3299 for the specific issue in your "Description" section
above. It seems conceivable that 1129648 also fixed something else,
e.g.,
1. Maybe the
"- add_action( 'wp_ajax_nopriv_fsb_save_order', array( $this, 'save_order' ) );"
code change means that wp_ajax_nopriv_fsb_save_order allowed
bypassing intended access control, even if the attacker did not
supply an XSS payload.
2. Maybe the patched code can help to prevent a CSRF attack against
an authenticated action handler.
If so, then additional CVE IDs would be needed.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVK2CbAAoJEKllVAevmvmsv8AH/3+lUbuTvK0BVSLHJ7UTXyyq
OXoj6s5bcx9o7N9pdGXfEfop9Uwq8T6l1sytFJ/btjJLo+H2k0wyqknz3INTw8pI
e0Vdd6eGOfBx6x/IUJDDV5biuTHG5/SVIYNghy0o6CWg5ihrDLA0UJ9u/7sdMZg8
lyHYE19RkzuQQrq1Ix/WVQiCqUxo1cwseFQFRTz87qiuvJNaB3aBdrsXAvydB9uA
TCmkLGTkZ9C1DiqlzAwSlsTooscNEy0kYLnoBxDhSO548x9GtrkB9EIVn5l36Zo9
5RGsz2MCxXrl1KafKY5R+e1czypYgkhIn7c+U80FGv5kMt7F0yQceq7mqEn674E=
=yUNM
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
