Portfolio Plugin up to 1.04 on WordPress instagram-portfolio Page options-general.php cross site request forgery : 8/20/2015 6:08:40 AM
 | Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >> From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
Portfolio Plugin up to 1.04 on WordPress instagram-portfolio Page options-general.php cross site request forgery
8/18/2015 7:00:00 PM
General
scipID: 77346
Affected: Portfolio Plugin up to 1.04
Published: 08/19/2015
Risk: problematic
Created: 08/20/2015
Entry: 67.3% complete
Summary
A vulnerability classified as problematic has been found in Portfolio Plugin up to 1.04 on WordPress. Affected is an unknown function of the file wp-admin/options-general.php of the component instagram-portfolio Page. The manipulation with an unknown input leads to a cross site request forgery vulnerability. This is going to have an impact on integrity.
The weakness was released 08/19/2015. This vulnerability is traded as CVE-2015-6523. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. Technical details are known, but there is no available exploit.
Upgrading to version 1.05 eliminates this vulnerability.CVSS
Base Score: 5.0 (CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N) [?]
Temp Score: 4.4 (CVSS2#E:ND/RL:OF/RC:ND) [?]
CPE
Exploiting
Class: Cross site request forgery
Local: No
Remote: Yes
Availability: No
Countermeasures
Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found
Upgrade: Portfolio Plugin 1.05
Timeline
08/19/2015 | Advisory disclosed
08/20/2015 | VulDB entry created
08/20/2015 | VulDB entry updated
Sources
CVE: CVE-2015-6523 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
