oss-sec mailing list archives
Re: CVE Request - CSRF vulnerability in the Google Analyticator Wordpress Plugin v6.4.9.3 before rev @1183563
From: cve-assign () mitre org
Date: Sun, 21 Jun 2015 09:45:29 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
http://seclists.org/fulldisclosure/2015/Jun/57 https://wordpress.org/support/topic/discovered-security-vulnerabilities-1
/wp-admin/options-general.php?page=google-analyticator.php&pageaction=ga_clear_cache /wp-admin/options-general.php?page=ga_reset
https://plugins.trac.wordpress.org/changeset/1183563
Apparently the corresponding change was: if (strstr($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'])) not a token-based solution. Use CVE-2015-4697 for the issue addressed by changeset/1183563. (It is possible that other CVE IDs may be needed for this plugin later.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVhr+PAAoJEKllVAevmvmsWccIAIhQ9sMks4zSRzjHqza9lXj+ v2fSRT4WJaHpx4QVzpKYuxSbMXjqjDdqZrT0N1ZGjcdOUz9EpNoZJCLdgudgoQVE mKuPemEaWObEsQHh06D1OXwss/tDLWclFc5OFNdL+PwSrJcXRbeu3OyVmVJi6AKi Wik7Ir8HuntCavqBNQAKNu+o7QhrbulscBNNNoOMkQ4h5Qwy+zuDhBYEpjQ19DuE K2hZKRxNwsPnN0w3ws5lab5KLVGnNCRXA/pWZNXsbbj6/XJedux9KvFO+mmg02YP yr56v97KraIc17rLob9cvRgoT6ucxyJffCpT0LrghhLxkuNKT75SIaSC4Uim0ZE= =0j3s -----END PGP SIGNATURE-----
Current thread:
- CVE Request - CSRF vulnerability in the Google Analyticator Wordpress Plugin v6.4.9.3 before rev @1183563 Nitin Venkatesh (Jun 19)
- Re: CVE Request - CSRF vulnerability in the Google Analyticator Wordpress Plugin v6.4.9.3 before rev @1183563 cve-assign (Jun 21)