Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 27 Jan 2015 17:23:20 +0100
From: Paolo Perego <paolo@...oredcode.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Cc: Dylan Kuhn <cyberhobo@...erhobo.net>
Subject: CVE request: XSS in search functionality for Geo Mashup Wordpress plugin

Citing the description, Geo Mashup is a plugin for Wordpress designed
to let you
save location information with posts, pages, and other WordPress objects.
These information can then be presented on interactive maps in many ways.

Plugin versions before 1.8.3 suffer from a cross site scripting
vulnerability when displaying search results. The search key was not
properly sanitized so an attacker can eventually inject arbitrary
javascript code.

Plugin author was contacted on December 16, and by January 11 the
vulnerability was fixed and plugin version 1.8.3 was released (
https://wordpress.org/plugins/geo-mashup/changelog/).


Paolo
-- 
$ cd /pub
$ more beer

Il primo blog di application security italiano morbido fuori e croccante
dentro: https://codiceinsicuro.it

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ