| Vulnerability Name: | CVE-2015-5714 (CCN-107849) | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2015-10-26 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2015-10-26 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-11-04 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) 5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Cross-Site Scripting | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2015-5714 Source: CCN Type: oss-sec Mailing List, Mon, 26 Oct 2015 20:32:44 +0100 CVE Request: Wordpress: Cross-site scripting vulnerability in the user list table Source: CCN Type: oss-sec Mailing List, Wed, 28 Oct 2015 00:55:17 -0400 (EDT) Re: CVE Request: Wordpress: Cross-site scripting vulnerability in the user list table Source: CCN Type: SECTRACK ID: 1033979 WordPress Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Bypass Publishing Permission Checks Source: DEBIAN Type: UNKNOWN DSA-3375 Source: DEBIAN Type: UNKNOWN DSA-3383 Source: BID Type: UNKNOWN 76745 Source: CCN Type: BID-76745 WordPress CVE-2015-5714 Cross Site Scripting Vulnerability Source: SECTRACK Type: UNKNOWN 1033979 Source: CONFIRM Type: Patch https://codex.wordpress.org/Version_4.3.1 Source: XF Type: UNKNOWN wordpress-cve20155714-xss(107849) Source: CONFIRM Type: UNKNOWN https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8 Source: CONFIRM Type: UNKNOWN https://security-tracker.debian.org/tracker/CVE-2015-5714 Source: CCN Type: WordPress Web Site WordPress 4.3.1 Security and Maintenance Release Source: CONFIRM Type: Patch, Vendor Advisory https://wordpress.org/news/2015/09/wordpress-4-3-1/ Source: MISC Type: UNKNOWN https://wpvulndb.com/vulnerabilities/8186 Source: CCN Type: WhiteSource Vulnerability Database CVE-2015-5714 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||