CVE-2012-4921

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-4921
Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change application settings or (2) conduct cross-site scripting (XSS) attacks.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/89441
http://secunia.com/advisories/51531 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dvs_custom_notification_project:dvs_custom_notification:1.0.1:*:*:*:*:wordpress:*:*
History

No history.

Information

Published : 2014-04-10 20:29

Updated : 2014-04-11 13:24

NVD link : CVE-2012-4921

Mitre link : CVE-2012-4921

CVE.ORG link : CVE-2012-4921

JSON object : View

Products Affected

dvs_custom_notification_project

  • dvs_custom_notification
CWE
CWE-352

Cross-Site Request Forgery (CSRF)