Full Disclosure mailing list archives
Information disclosure race condition in W3 Total Cache WordPress Plugin
From: Summer of Pwnage <lists () securify nl>
Date: Thu, 10 Nov 2016 19:15:28 +0100
------------------------------------------------------------------------ Information disclosure race condition in W3 Total Cache WordPress Plugin ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ An information disclosure vulnerability was found in the W3 Total Cache plugin. This issue allows an attacker to hijack sensitive information, such as the administrator's session cookie. Exploiting the vulnerability is possible during a short period of time when an administrator submits the support form. ------------------------------------------------------------------------ OVE ID ------------------------------------------------------------------------ OVE-20160724-0002 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully tested on the W3 Total Cache WordPress Plugin version 0.9.4.1. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue is resolved in W3 Total Cache version 0.9.5. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://sumofpwn.nl/advisory/2016/information_disclosure_race_condition_in_w3_total_cache_wordpress_plugin.html ------------------------------------------------------------------------ Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Information disclosure race condition in W3 Total Cache WordPress Plugin Summer of Pwnage (Nov 10)