CVE-2014-9437

Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/129509	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/99510

Configurations

Configuration 1 (hide)

cpe:2.3:a:sliding_social_icons_project:sliding_social_icons:1.61:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2015-01-02 19:59

Updated : 2024-02-28 12:20

NVD link : CVE-2014-9437

Mitre link : CVE-2014-9437

CVE.ORG link : CVE-2014-9437

JSON object : View

Products Affected

sliding_social_icons_project

sliding_social_icons

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2014-9437", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-01-02T19:59:06.250", "references": [{"url": "http://packetstormsecurity.com/files/129509", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99510", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site scripting (XSS) attacks via the sc_social_slider_margin parameter in a wpbs_save_settings action in the wpbs_panel page to wp-admin/admin.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de CSRf en el plugin Sliding Social Icons 1.61 para WordPress permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que (1) cambian las configuraciones de pluugins a trav\u00e9s de vectores no especificados o (2) realizan ataques de XSS a trav\u00e9s del par\u00e1metro sc_social_slider_margin en una acci\u00f3n wpbs_save_settings en la p\u00e1gina wpbs_panel en wp-admin/admin.php."}], "lastModified": "2017-09-08T01:29:34.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sliding_social_icons_project:sliding_social_icons:1.61:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "9E345E3E-B60C-416B-B906-D0B50F777278"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}