2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2015-3439" ,
"sourceIdentifier" : "security@debian.org" ,
"published" : "2015-08-05T10:59:00.263" ,
2024-12-08 03:06:42 +00:00
"lastModified" : "2024-11-21T02:29:25.663" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as."
} ,
{
"lang" : "es" ,
"value" : "Vulnerabilidad de XSS en el shim Ephox (anteriormente Moxiecode) plupload.flash.swf 2.1.2 en Plupload, tal como se utiliza en WordPress 3.9.x, 4.0.x y 4.1.x en versiones anteriores a 4.1.2 y otros productos, permite a atacantes remotos ejecutar funciones JavaScript del mismo origen a trav\u00e9s del par\u00e1metro target, seg\u00fan lo demostrado ejecutando cierta funci\u00f3n de clic, relacionada con _init.as y _fireEvents.as."
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 4.3 ,
2023-04-24 12:24:31 +02:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "PARTIAL" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : true
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "16F59A04-14CF-49E2-9973-645477EA09DA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CB4D4609-5AD6-44F3-B991-74E35A7E5C2D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B79DE40E-BFA7-43DA-AB42-2812FB207941"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5EED9381-2BFC-4BDA-AC4B-CBC77E8538D4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:3.9.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D0FDD6C2-CD33-4812-9962-3BE73D450C33"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E372A3D2-FCB5-4A74-840D-EC03732FCC97"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:4.0.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "22427650-230D-4CB0-BACC-723B9B2CDC31"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:4.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "18F20563-46BB-4E5C-BEF5-122A32C76261"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:wordpress:wordpress:4.1.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "74AF56DD-82D6-4100-B82C-536C46358B07"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://codex.wordpress.org/Version_4.1.2" ,
"source" : "security@debian.org" ,
"tags" : [
"Exploit" ,
"Patch"
]
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://www.debian.org/security/2015/dsa-3250" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://www.securityfocus.com/bid/74269" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://www.securitytracker.com/id/1032207" ,
"source" : "security@debian.org"
} ,
{
"url" : "http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html" ,
"source" : "security@debian.org" ,
"tags" : [
"Exploit"
]
} ,
{
"url" : "https://core.trac.wordpress.org/changeset/32168" ,
"source" : "security@debian.org"
} ,
{
"url" : "https://wordpress.org/news/2015/04/wordpress-4-1-2/" ,
"source" : "security@debian.org" ,
"tags" : [
"Exploit" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://wpvulndb.com/vulnerabilities/7933" ,
"source" : "security@debian.org"
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "http://codex.wordpress.org/Version_4.1.2" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit" ,
"Patch"
]
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://www.debian.org/security/2015/dsa-3250" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://www.securityfocus.com/bid/74269" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://www.securitytracker.com/id/1032207" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit"
]
} ,
{
"url" : "https://core.trac.wordpress.org/changeset/32168" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
} ,
{
"url" : "https://wordpress.org/news/2015/04/wordpress-4-1-2/" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://wpvulndb.com/vulnerabilities/7933" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108"
2023-04-24 12:24:31 +02:00
}
]
}
