oss-sec mailing list archives
Re: Persistent XSS in Media File Renamer V1.7.0
From: cve-assign () mitre org
Date: Thu, 20 Feb 2014 13:00:42 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/ Download: http://www.meow.fr/media-file-renamer/
mfrh_class.settings-api.php function callback_multicheck function callback_radio function callback_wysiwyg
If a user with permission to add media or edit media uploads a file
the title
can XSS the site admin
Use CVE-2014-2040. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTBkJtAAoJEKllVAevmvms3jAIALKsp0q1fkWAPIkGYwnFzMzS mpitvFIGpXCb/7MflVzCfo2AkVHT7/7F4sWiPMVDduTnjHGuWRDQhJu6B6t3csS4 D9CmYtY3IIYpLZ5CwtU2QWN2B4ThIiRzQDSLIDl9zmjzvuZJ88fB/p0g2RUOF4vw 26hNokJflz3rO7EavufeDbjXffIOsbCX4Xmjy1dQEwq35IMwrlRogSFnvuFu7fcA 2IReU1oRPmGs7Ly8btzGIRZ1IEzP0sxFYBYmP3wnuUgMKlmQGH9ISAS3tNWaXamg CwWPP5DnlyJ/5kEWoyABWZaOXDMu/Z9fQraIw3VjlvKj6iIjT2wMPoZc8YV/AdQ= =xBmt -----END PGP SIGNATURE-----
Current thread:
- Persistent XSS in Media File Renamer V1.7.0 Larry W. Cashdollar (Feb 20)
- Re: Persistent XSS in Media File Renamer V1.7.0 cve-assign (Feb 20)