Vulnerability CVE-2013-2107
Published: 2014-05-22   Modified: 2014-05-23

Description:
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
WordPress plugin mail-on-update CSRF
Henri Salo
16.05.2013

Type:

CWE-352

 (Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Mail on update project -> Mail on update 

 References:
http://wordpress.org/plugins/mail-on-update/changelog
http://secunia.com/advisories/53449
http://seclists.org/oss-sec/2013/q2/356
http://osvdb.org/93452
Copyright 2024, cxsecurity.com

 

Back to Top