CVE-2019-9669

{"id": "CVE-2019-9669", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-04-25T19:29:01.377", "references": [{"url": "https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)"}, {"lang": "es", "value": "** EN DISPUTA ** El plugin Wordfence 7.2.3 para WordPress permite Cross-Site Scripting (XSS) mediante un \u00fanico vector de ataque. NOTA: Se ha afirmado que esta no es una vulnerabilidad v\u00e1lida en el contexto del plugin de Wordfence para WordPress, ya que las reglas del cortafuegos no se mantienen como parte del software de Wordfence, sino que se trata de un conjunto de reglas alojadas en los servidores del proveedor y enviadas al plugin sin ning\u00fan tipo de control de versiones. Eludir una regla de WAF no hace que un sitio de WordPress sea vulnerable (hablando en t\u00e9rminos de vulnerabilidades de software)"}], "lastModified": "2024-11-21T04:52:04.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordfence:wordfence:7.2.3:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "16CC8BAC-296A-4238-962E-3595098F4A49"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}