The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.
References
Configurations
History
26 May 2023, 17:46
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:* |
Information
Published : 2014-12-24 18:59
Updated : 2024-02-04 18:35
NVD link : CVE-2014-9414
Mitre link : CVE-2014-9414
CVE.ORG link : CVE-2014-9414
JSON object : View
Products Affected
boldgrid
- w3_total_cache
CWE
CWE-352
Cross-Site Request Forgery (CSRF)