CVE-2018-1000511

{"id": "CVE-2018-1000511", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-06-26T16:29:00.900", "references": [{"url": "https://advisories.dxw.com/advisories/wp-ulike-delete-rows/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://advisories.dxw.com/advisories/wp-ulike-delete-rows/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2."}, {"lang": "es", "value": "WP ULike 2.8.1 y 3.1 contiene una vulnerabilidad de control de acceso incorrecto en AJAX que puede resultar en que cualquiera pueda eliminar cualquier fila en determinadas tablas. El ataque parece ser explotable mediante un atacante que realice una petici\u00f3n AJAX. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 3.2."}], "lastModified": "2024-11-21T03:40:05.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpulike:ulike:2.8.1:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "7468448F-02BF-4ED0-B228-F679FC2F84CD"}, {"criteria": "cpe:2.3:a:wpulike:ulike:3.1:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "DA007C01-700B-48A0-A155-B91DAC5BCA26"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}