CVE-2015-5714

Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.

CVSS v3.0 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://security-tracker.debian.org/tracker/CVE-2015-5714
https://wordpress.org/news/2015/09/wordpress-4-3-1/	Patch Vendor Advisory
https://codex.wordpress.org/Version_4.3.1	Patch
https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8
http://www.securityfocus.com/bid/76745
https://wpvulndb.com/vulnerabilities/8186
http://www.securitytracker.com/id/1033979
http://www.debian.org/security/2015/dsa-3383
http://www.debian.org/security/2015/dsa-3375

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Information

Published : 2016-05-21 18:59

Updated : 2017-11-03 18:29

NVD link : CVE-2015-5714

Mitre link : CVE-2015-5714

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

wordpress

wordpress

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://security-tracker.debian.org/tracker/CVE-2015-5714", "name": "https://security-tracker.debian.org/tracker/CVE-2015-5714", "tags": [], "refsource": "CONFIRM"}, {"url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/", "name": "https://wordpress.org/news/2015/09/wordpress-4-3-1/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://codex.wordpress.org/Version_4.3.1", "name": "https://codex.wordpress.org/Version_4.3.1", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8", "name": "https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/76745", "name": "76745", "tags": [], "refsource": "BID"}, {"url": "https://wpvulndb.com/vulnerabilities/8186", "name": "https://wpvulndb.com/vulnerabilities/8186", "tags": [], "refsource": "MISC"}, {"url": "http://www.securitytracker.com/id/1033979", "name": "1033979", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.debian.org/security/2015/dsa-3383", "name": "DSA-3383", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2015/dsa-3375", "name": "DSA-3375", "tags": [], "refsource": "DEBIAN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5714", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}}, "publishedDate": "2016-05-22T01:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.3.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-11-04T01:29Z"}