CVE-2014-5347

19.08.2014, 19:55

Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.

CSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	6.8 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P
mitre	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Vendor	Product	Version
disqus	disqus_comment_system	𝑥 ≤ 2.75
disqus	disqus_comment_system	2.40
disqus	disqus_comment_system	2.41
disqus	disqus_comment_system	2.42
disqus	disqus_comment_system	2.43
disqus	disqus_comment_system	2.44
disqus	disqus_comment_system	2.45
disqus	disqus_comment_system	2.46
disqus	disqus_comment_system	2.47
disqus	disqus_comment_system	2.48
disqus	disqus_comment_system	2.49
disqus	disqus_comment_system	2.50
disqus	disqus_comment_system	2.51
disqus	disqus_comment_system	2.52
disqus	disqus_comment_system	2.53
disqus	disqus_comment_system	2.54
disqus	disqus_comment_system	2.55
disqus	disqus_comment_system	2.60
disqus	disqus_comment_system	2.61
disqus	disqus_comment_system	2.62
disqus	disqus_comment_system	2.63
disqus	disqus_comment_system	2.64
disqus	disqus_comment_system	2.65
disqus	disqus_comment_system	2.66
disqus	disqus_comment_system	2.67
disqus	disqus_comment_system	2.68
disqus	disqus_comment_system	2.69
disqus	disqus_comment_system	2.70
disqus	disqus_comment_system	2.71
disqus	disqus_comment_system	2.72
disqus	disqus_comment_system	2.73
disqus	disqus_comment_system	2.74