Headline

CVE-2017-20097: Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin

A vulnerability was found in WP-Filebase Download Manager Plugin 3.4.4. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely.

2 years ago

CVE

Open in Source

#xss #vulnerability #web #wordpress

Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev

Full Disclosure mailing list archives

From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:01:18 +0100

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin

Yorick Koster, July 2016

Abstract

A Cross-Site Scripting vulnerability was found in the WP-Filebase Download Manager WordPress Plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing Administrators’ session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a logged on WordPress Administrator into opening a malicious website.

OVE ID

OVE-20160712-0019

Tested versions

This issue was successfully tested on WP-Filebase Download Manager WordPress Plugin version 3.4.4.

Fix

There is currently no fix available.

Details

https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_wp_filebase_download_manager_wordpress_plugin.html

Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.

_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/

Current thread: