NVD Vulnerability Detail

CVE-2013-4241

Summary	Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
Publication Date	Jan. 31, 2020, 6:15 a.m.
Registration Date	Jan. 26, 2021, 3:42 p.m.
Last Update	Nov. 21, 2024, 10:55 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:hitmyserver:hms_testimonials::::::wordpress::*					2.0.11

Related information, measures and tools

No	URL	タグ
1	http://seclists.org/fulldisclosure/2013/Aug/96	Exploit Mailing List Third Party Advisory
2	http://seclists.org/fulldisclosure/2013/Aug/96	Exploit Mailing List Third Party Advisory
3	http://seclists.org/fulldisclosure/2013/Aug/98	Exploit Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2013/Aug/98	Exploit Mailing List Third Party Advisory
5	http://seclists.org/oss-sec/2013/q3/345	Mailing List Third Party Advisory
6	http://seclists.org/oss-sec/2013/q3/345	Mailing List Third Party Advisory
7	http://seclists.org/oss-sec/2013/q3/361	Mailing List Third Party Advisory
8	http://seclists.org/oss-sec/2013/q3/361	Mailing List Third Party Advisory
9	https://wordpress.org/plugins/hms-testimonials/#developers	Release Notes
10	https://wordpress.org/plugins/hms-testimonials/#developers	Release Notes

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

WordPress 用 HMS Testimonials プラグインにおけるクロスサイトスクリプティングの脆弱性

Title	WordPress 用 HMS Testimonials プラグインにおけるクロスサイトスクリプティングの脆弱性
Summary	WordPress 用 HMS Testimonials プラグインには、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 8, 2013, midnight
Registration Date	Feb. 17, 2020, 3:10 p.m.
Last Update	Feb. 17, 2020, 3:10 p.m.

Affected System

HitMyServer

HMS Testimonials 2.0.11 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4241	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4241
National Vulnerability Database (NVD)
2	CVE-2013-4241	https://nvd.nist.gov/vuln/detail/CVE-2013-4241

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
WordPress Plugin Directory
1	HMS Testimonials	https://wordpress.org/plugins/hms-testimonials/#developers

その他

No	Name	URL
関連文書
1	[RCA-201308-01] HMS Testimonials 2.0.10 WP plugin - Multiple vulnerabilities	https://seclists.org/fulldisclosure/2013/Aug/96

Change Log

No	Changed Details	Date of change
1	[2020年02月17日] 掲載	Feb. 17, 2020, 3:10 p.m.