NVD Vulnerability Detail

CVE-2015-10125

Summary	A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Publication Date	Oct. 6, 2023, 8:15 a.m.
Registration Date	Oct. 6, 2023, 10 a.m.
Last Update	Nov. 21, 2024, 11:24 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv::::::wordpress::*					3.7.3

Related information, measures and tools

No	URL	タグ
1	https://github.com/wp-plugins/wp-ultimate-csv-importer/commit/13c30af721d3f989caac72dd0f56cf0dc40fad7e	Patch
2	https://github.com/wp-plugins/wp-ultimate-csv-importer/commit/13c30af721d3f989caac72dd0f56cf0dc40fad7e	Patch
3	https://github.com/wp-plugins/wp-ultimate-csv-importer/releases/tag/3.7.3	Release Notes
4	https://github.com/wp-plugins/wp-ultimate-csv-importer/releases/tag/3.7.3	Release Notes
5	https://vuldb.com/?ctiid.241317	Third Party Advisory
6	https://vuldb.com/?ctiid.241317	Third Party Advisory
7	https://vuldb.com/?id.241317	Third Party Advisory
8	https://vuldb.com/?id.241317	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Smackcoders の WordPress 用 Import All Pages, Post types, Products, Orders, and Users as XML & CSV におけるクロスサイトリクエストフォージェリの脆弱性

Title	Smackcoders の WordPress 用 Import All Pages, Post types, Products, Orders, and Users as XML & CSV におけるクロスサイトリクエストフォージェリの脆弱性
Summary	Smackcoders の WordPress 用 Import All Pages, Post types, Products, Orders, and Users as XML & CSV には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 5, 2023, midnight
Registration Date	Dec. 25, 2023, 10:41 a.m.
Last Update	Dec. 25, 2023, 10:41 a.m.

Affected System

Smackcoders

Import All Pages, Post types, Products, Orders, and Users as XML & CSV 3.7.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-10125	https://www.cve.org/CVERecord?id=CVE-2015-10125
National Vulnerability Database (NVD)
2	CVE-2015-10125	https://nvd.nist.gov/vuln/detail/CVE-2015-10125

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

その他

No	Name	URL
関連文書
1	github.com (13c30af721d3f989caac72dd0f56cf0dc40fad7e)	https://github.com/wp-plugins/wp-ultimate-csv-importer/commit/13c30af721d3f989caac72dd0f56cf0dc40fad7e
2	github.com (3.7.3)	https://github.com/wp-plugins/wp-ultimate-csv-importer/releases/tag/3.7.3
3	vuldb.com (ctiid.241317)	https://vuldb.com/?ctiid.241317
4	vuldb.com (id.241317)	https://vuldb.com/?id.241317

Change Log

No	Changed Details	Date of change
1	[2023年12月25日] 掲載	Dec. 25, 2023, 10:41 a.m.