CVE-2014-9735

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/	Vendor Advisory
https://wpvulndb.com/vulnerabilities/7954
https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html	Exploit
http://seclists.org/fulldisclosure/2014/Nov/78	Exploit
https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php
https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/	Exploit
http://www.securityfocus.com/bid/71306

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*

Configuration 2 (hide)

cpe:2.3:a:themepunch:slider_revolution:*:*:*:*:*:wordpress:*:*

Information

Published : 2015-06-30 07:59

Updated : 2016-11-28 11:14

NVD link : CVE-2014-9735

Mitre link : CVE-2014-9735

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

themepunch

showbiz_pro
slider_revolution

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/", "name": "http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://wpvulndb.com/vulnerabilities/7954", "name": "https://wpvulndb.com/vulnerabilities/7954", "tags": [], "refsource": "MISC"}, {"url": "https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html", "name": "https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://seclists.org/fulldisclosure/2014/Nov/78", "name": "20151125 Slider Revolution/Showbiz Pro shell upload exploit", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php", "name": "https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php", "tags": [], "refsource": "MISC"}, {"url": "https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/", "name": "https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/71306", "name": "71306", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-9735", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-06-30T14:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.7.1"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:themepunch:slider_revolution:*:*:*:*:*:wordpress:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.0.95"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2016-11-28T19:14Z"}