Lucene search

MitreCVE-2015-1582

HistoryFeb 11, 2015 - 7:59 p.m.

CVE-2015-1582

2015-02-1119:59:09

CWE-79

mitre

web.nvd.nist.gov

cve

2015

1582

xss

vulnerabilities

spider

facebook

plugin

wordpress

remote

injection

html

web script

admin

parameters

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

52.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or © selectpostsforfacebook action to wp-admin/admin-ajax.php.

Affected configurations

Nvd

Node

web-doradospider_facebookRange≤1.0.10wordpress

VendorProductVersionCPE
web-doradospider_facebook*cpe:2.3:a:web-dorado:spider_facebook:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
web-dorado	spider_facebook	*	cpe:2.3:a:web-dorado:spider_facebook::::::wordpress::*

References

packetstormsecurity.com/files/130318/WordPress-Spider-Facebook-1.0.10-Cross-Site-Scripting.html

wordpress.org/plugins/spider-facebook/changelog/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

52.3%

JSON

Related for CVE-2015-1582