Headline

CVE-2017-20085: Cross-Site Scripting in Atahualpa WordPress Theme

A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.

2 years ago

CVE

Open in Source

#xss #csrf #vulnerability #web #wordpress

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

Full Disclosure mailing list archives

From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:08:41 +0100

------------------------------------------------------------------------ Cross-Site Scripting in Atahualpa WordPress Theme

Spyros Gasteratos, July 2016

Abstract

A number of Cross-Site Scripting vulnerabilities were found in the Atahualpa WordPress Theme. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators’ session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to use the CSRF vulnerability described in SFY20160759 to trick the admin into storing malicious input.

OVE ID

OVE-20160724-0004

Tested versions

This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme.

Fix

There is currently no fix available.

Details

https://sumofpwn.nl/advisory/2016/cross_site_scripting_in_atahualpa_wordpress_theme.html

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.

_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/

Current thread: