Re: CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress option value disclosure

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Affected software: Slideshow (Wordpress plugin)
> Affected versions: 2.2.8 - 2.2.21
> Fixed version: 2.2.22

> https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
> https://wordpress.org/plugins/slideshow-jquery-image-gallery/changelog/

> The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function,
> accessible by unauthenticated users as an AJAX action, can be abused
> to force the disclosure of arbitrary Wordpress option values.

> it is
> possible to specify any option name in place of an actual custom
> stylesheet name, regardless of whether the option is for the Slideshow
> plugin, another plugin, a theme, or Wordpress itself.

Use CVE-2015-3634.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVRPKFAAoJEKllVAevmvmslEkIAKfU5CaT5Z4TR0qjTxX4Az1F
e9j4AOp7Qo0seY6paX3H+V+IRNdJsjuXJ2/h4nZEbpJN3R8ZmziWX3d/RQHTPy7i
qr+hsyIFnNICYHxqLU0KoIowPP+bXMyTFuyUwzlQMmxtXtgGxWQHQhkWmnS6HZnO
ApNevU0SoAa8yerGYqL3YxcAGgQ1+BucFwbHd6ORjtKq/S+Xa/wwni7dOuEmYl6K
xOxo+bIW+8BLffYkgi5r9kOtdjfM/1D9qZsQoSo9D2c+pKQ9Al9IijngQ1KooN8I
c7oahuQP9ncqOIELnT9WO2D46/F4fWdgYRv01tKYiJjD/D/sd5Sq/6+/JTV04LM=
=q5hN
-----END PGP SIGNATURE-----