CVE-2015-3439

{"id": "CVE-2015-3439", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-08-05T10:59:00.263", "references": [{"url": "http://codex.wordpress.org/Version_4.1.2", "tags": ["Exploit", "Patch"], "source": "security@debian.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html", "source": "security@debian.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html", "source": "security@debian.org"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html", "source": "security@debian.org"}, {"url": "http://www.debian.org/security/2015/dsa-3250", "source": "security@debian.org"}, {"url": "http://www.securityfocus.com/bid/74269", "source": "security@debian.org"}, {"url": "http://www.securitytracker.com/id/1032207", "source": "security@debian.org"}, {"url": "http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html", "tags": ["Exploit"], "source": "security@debian.org"}, {"url": "https://core.trac.wordpress.org/changeset/32168", "source": "security@debian.org"}, {"url": "https://wordpress.org/news/2015/04/wordpress-4-1-2/", "tags": ["Exploit", "Vendor Advisory"], "source": "security@debian.org"}, {"url": "https://wpvulndb.com/vulnerabilities/7933", "source": "security@debian.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as."}, {"lang": "es", "value": "Vulnerabilidad de XSS en el shim Ephox (anteriormente Moxiecode) plupload.flash.swf 2.1.2 en Plupload, tal como se utiliza en WordPress 3.9.x, 4.0.x y 4.1.x en versiones anteriores a 4.1.2 y otros productos, permite a atacantes remotos ejecutar funciones JavaScript del mismo origen a trav\u00e9s del par\u00e1metro target, seg\u00fan lo demostrado ejecutando cierta funci\u00f3n de clic, relacionada con _init.as y _fireEvents.as."}], "lastModified": "2016-12-06T03:01:00.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB4D4609-5AD6-44F3-B991-74E35A7E5C2D"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B79DE40E-BFA7-43DA-AB42-2812FB207941"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EED9381-2BFC-4BDA-AC4B-CBC77E8538D4"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:3.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0FDD6C2-CD33-4812-9962-3BE73D450C33"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E372A3D2-FCB5-4A74-840D-EC03732FCC97"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22427650-230D-4CB0-BACC-723B9B2CDC31"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18F20563-46BB-4E5C-BEF5-122A32C76261"}, {"criteria": "cpe:2.3:a:wordpress:wordpress:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74AF56DD-82D6-4100-B82C-536C46358B07"}], "operator": "OR"}]}], "sourceIdentifier": "security@debian.org"}