CVE-2014-2598

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-2598
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin/admin.php.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/show/osvdb/105707
http://osvdb.org/show/osvdb/105708
http://packetstormsecurity.com/files/126127 Exploit
http://seclists.org/fulldisclosure/2014/Apr/171 Exploit
http://secunia.com/advisories/57883
http://www.exploit-db.com/exploits/32867 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/92528
https://security.dxw.com/advisories/csrf-and-stored-xss-in-quick-pagepost-redirect-plugin/ Exploit
https://wordpress.org/plugins/quick-pagepost-redirect-plugin/changelog/ Patch Vendor Advisory
http://osvdb.org/show/osvdb/105707
http://osvdb.org/show/osvdb/105708
http://packetstormsecurity.com/files/126127 Exploit
http://seclists.org/fulldisclosure/2014/Apr/171 Exploit
http://secunia.com/advisories/57883
http://www.exploit-db.com/exploits/32867 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/92528
https://security.dxw.com/advisories/csrf-and-stored-xss-in-quick-pagepost-redirect-plugin/ Exploit
https://wordpress.org/plugins/quick-pagepost-redirect-plugin/changelog/ Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:quick_page\/post_redirect_project:quick_page\/post_redirect:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 02:06

Type Values Removed Values Added
References () http://osvdb.org/show/osvdb/105707 - () http://osvdb.org/show/osvdb/105707 -
References () http://osvdb.org/show/osvdb/105708 - () http://osvdb.org/show/osvdb/105708 -
References () http://packetstormsecurity.com/files/126127 - Exploit () http://packetstormsecurity.com/files/126127 - Exploit
References () http://seclists.org/fulldisclosure/2014/Apr/171 - Exploit () http://seclists.org/fulldisclosure/2014/Apr/171 - Exploit
References () http://secunia.com/advisories/57883 - () http://secunia.com/advisories/57883 -
References () http://www.exploit-db.com/exploits/32867 - Exploit () http://www.exploit-db.com/exploits/32867 - Exploit
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/92528 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/92528 -
References () https://security.dxw.com/advisories/csrf-and-stored-xss-in-quick-pagepost-redirect-plugin/ - Exploit () https://security.dxw.com/advisories/csrf-and-stored-xss-in-quick-pagepost-redirect-plugin/ - Exploit
References () https://wordpress.org/plugins/quick-pagepost-redirect-plugin/changelog/ - Patch, Vendor Advisory () https://wordpress.org/plugins/quick-pagepost-redirect-plugin/changelog/ - Patch, Vendor Advisory
Information

Published : 2015-01-05 20:59

Updated : 2024-11-21 02:06

NVD link : CVE-2014-2598

Mitre link : CVE-2014-2598

CVE.ORG link : CVE-2014-2598

JSON object : View

Products Affected

quick_page\/post_redirect_project

  • quick_page\/post_redirect
CWE
CWE-352

Cross-Site Request Forgery (CSRF)