NVD Vulnerability Detail

CVE-2013-1409

Summary	Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
Publication Date	March 4, 2014, 1:55 a.m.
Registration Date	Jan. 26, 2021, 3:36 p.m.
Last Update	Nov. 21, 2024, 10:49 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:commentluv:commentluv::::::wordpress::*			2.92.3
cpe:2.3:a:commentluv:commentluv:2.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.71:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.74:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.76:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.80:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.4:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.4:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.91:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.91.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.761:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.762:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.763:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.764:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.765:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.766:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.767:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.768:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.769:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.7691:::::wordpress::
execution environment
1	cpe:2.3:a:wordpress:wordpress:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2013-02/0031.html	Exploit
2	http://archives.neohapsis.com/archives/bugtraq/2013-02/0031.html	Exploit
3	http://osvdb.org/89925
4	http://osvdb.org/89925
5	http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html	Exploit
6	http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html	Exploit
7	http://wordpress.org/plugins/commentluv/changelog
8	http://wordpress.org/plugins/commentluv/changelog
9	https://www.htbridge.com/advisory/HTB23138	Exploit
10	https://www.htbridge.com/advisory/HTB23138	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

WordPress 用 CommentLuv プラグインにおけるクロスサイトスクリプティングの脆弱性

Title	WordPress 用 CommentLuv プラグインにおけるクロスサイトスクリプティングの脆弱性
Summary	WordPress 用 CommentLuv プラグインには、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、wp-admin/admin-ajax.php の _ajax_nonce パラメータを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 6, 2013, midnight
Registration Date	March 5, 2014, 5:13 p.m.
Last Update	March 5, 2014, 5:13 p.m.

Affected System

Andy Bailey

CommentLuv 2.92.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-1409	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1409
National Vulnerability Database (NVD)
2	CVE-2013-1409	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1409

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
ComLuv
1	CommentLuv WordPress	http://comluv.com/download/commentluv-wordpress/
WordPress Plugin Directory
2	CommentLuv	http://wordpress.org/plugins/commentluv/changelog/

その他

No	Name	URL
関連文書
1	Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin	https://www.htbridge.com/advisory/HTB23138

Change Log

No	Changed Details	Date of change
0	[2014年03月05日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:commentluv:commentluv::::::wordpress::*			2.92.3
cpe:2.3:a:commentluv:commentluv:2.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.71:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.74:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.76:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.80:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.4:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.81.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.8.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.4:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.5:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.6:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.7:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.8:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.90.9.9.3:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.91:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.91.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92.1:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.92.2:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.761:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.762:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.763:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.764:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.765:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.766:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.767:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.768:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.769:::::wordpress::
cpe:2.3:a:commentluv:commentluv:2.7691:::::wordpress::
execution environment
1	cpe:2.3:a:wordpress:wordpress:-:::::::*