Lucene search

[email protected]CVE-2015-2292

HistoryMar 17, 2015 - 3:59 p.m.

CVE-2015-2292

2015-03-1715:59:00

CWE-89

[email protected]

web.nvd.nist.gov

128

cve-2015-2292

sql injection

wordpress

yoast

nvd

vulnerability

admin page

csrf

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.4 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.4%

JSON

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.

Affected configurations

NVD

Node

yoastwordpress_seoRange≤1.5.6wordpress

yoastwordpress_seoMatch1.6.0wordpress

yoastwordpress_seoMatch1.6.1wordpress

yoastwordpress_seoMatch1.6.2wordpress

yoastwordpress_seoMatch1.6.3wordpress

yoastwordpress_seoMatch1.7.1wordpress

yoastwordpress_seoMatch1.7.2wordpress

yoastwordpress_seoMatch1.7.3wordpress

yoastwordpress_seoMatch1.7.3.1wordpress

yoastwordpress_seoMatch1.7.3.2wordpress

yoastwordpress_seoMatch1.7.3.3wordpress

CPENameOperatorVersion
yoast:wordpress_seoyoast wordpress seole1.5.6
yoast:wordpress_seoyoast wordpress seoeq1.6.0
yoast:wordpress_seoyoast wordpress seoeq1.6.1
yoast:wordpress_seoyoast wordpress seoeq1.6.2
yoast:wordpress_seoyoast wordpress seoeq1.6.3
yoast:wordpress_seoyoast wordpress seoeq1.7.1
yoast:wordpress_seoyoast wordpress seoeq1.7.2
yoast:wordpress_seoyoast wordpress seoeq1.7.3
yoast:wordpress_seoyoast wordpress seoeq1.7.3.1
yoast:wordpress_seoyoast wordpress seoeq1.7.3.2

CPE	Name	Operator	Version
yoast:wordpress_seo	yoast wordpress seo	le	1.5.6
yoast:wordpress_seo	yoast wordpress seo	eq	1.6.0
yoast:wordpress_seo	yoast wordpress seo	eq	1.6.1
yoast:wordpress_seo	yoast wordpress seo	eq	1.6.2
yoast:wordpress_seo	yoast wordpress seo	eq	1.6.3
yoast:wordpress_seo	yoast wordpress seo	eq	1.7.1
yoast:wordpress_seo	yoast wordpress seo	eq	1.7.2
yoast:wordpress_seo	yoast wordpress seo	eq	1.7.3
yoast:wordpress_seo	yoast wordpress seo	eq	1.7.3.1
yoast:wordpress_seo	yoast wordpress seo	eq	1.7.3.2