| Title | Wordpress 用 WP Ultimate Email Marketer プラグインにおけるクロスサイトスクリプティングの脆弱性 |
|---|---|
| Summary | Wordpress 用 WP Ultimate Email Marketer プラグインには、クロスサイトスクリプティングの脆弱性が存在します。 |
| Possible impacts | 第三者により、下記のパラメータを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。 (1) campaign/campaignone.php の siteurl パラメータ (2) campaign/campaigntwo.php の action パラメータ (3) campaign/campaigntwo.php の campaignname パラメータ (4) campaign/campaigntwo.php の campaignformat パラメータ (5) campaign/campaigntwo.php の emailtemplate パラメータ (6) list/edit.php の listid パラメータ (7) campaign/editcampaign.php の campaignid パラメータ (8) campaign/editcampaign.php の siteurl パラメータ (9) campaign/selectlistb4send.php の campaignid パラメータ (10) campaign/sendCampaign.php の campaignid パラメータ (11) campaign/sendCampaign.php の campaignname パラメータ (12) campaign/sendCampaign.php の campaignsubject パラメータ (13) campaign/sendCampaign.php の selectedcampaigns パラメータ (14) campaign/updatecampaign.php の campaignid パラメータ (15) campaign/updatecampaign.php の campaignname パラメータ (16) campaign/updatecampaign.php の campaignformat パラメータ (17) campaign/updatecampaign.php の action パラメータ |
| Solution | ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date | Sept. 24, 2013, midnight |
| Registration Date | Nov. 7, 2013, 4:06 p.m. |
| Last Update | Nov. 7, 2013, 4:06 p.m. |
| CVSS2.0 : 警告 | |
| Score | 4.3 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| Smackcoders |
| WP Ultimate Email Marketer 1.1.0 およびそれ以前 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2013年11月07日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php. |
|---|---|
| Publication Date | Nov. 6, 2013, 5:55 a.m. |
| Registration Date | Jan. 26, 2021, 3:40 p.m. |
| Last Update | Nov. 21, 2024, 10:53 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.1:-:*:*:*:wordpress:*:* | |||||
| cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.2:-:*:*:*:wordpress:*:* | |||||
| cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:*:-:*:*:*:wordpress:*:* | 1.1.0 | ||||
| cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.0:-:*:*:*:wordpress:*:* | |||||
| cpe:2.3:a:smackcoders:wp_ultimate_email_marketer_plugin:1.0.3:-:*:*:*:wordpress:*:* | |||||