[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 16 Jun 2015 15:29:19 -0400 (EDT)
From: cve-assign@...re.org
To: venkatesh.nitin@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request - Cross-Site Request Forgery Vulnerability in Users to CSV Wordpress Plugin v1.4.5
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I've discovered a CSRF vulnerability in the Users to CSV Wordpress Plugin
> v1.4.5 which allows for user information can be exported via a GET request
> to users.php. I request a CVE for the same.
>
> http://seclists.org/fulldisclosure/2015/Jun/44
We typically don't have CVEs for CSRF issues in which the impact is
information disclosure, because the information is disclosed to the
victim rather than to the attacker.
Is there any way that the attacker can specify that the CSV data
should be written to a file with a public URL served by the web
server, so that the attacker can read it later? The source code
perhaps suggests that the data is always sent to the victim, e.g.,
https://plugins.svn.wordpress.org/users-to-csv/trunk/users2csv.php
if ( is_admin() ) {
...
header('Content-Disposition: attachment; filename="'.$table.'.csv"');
...
echo $csv;
Possibly there is a concern that the user data is sensitive
information that might be transmitted over an insecure network path in
cleartext during the CSRF attack, and this might be a network path
that the admin would avoid during any intentional access to the
WordPress installation. However, this is not the type of CSRF impact
that normally has a CVE, and the scenario in question could be
considered a site-specific problem or user error (i.e., either follow
http://codex.wordpress.org/Administration_Over_SSL or at least don't
remain logged in after moving the client machine to an especially
insecure network).
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVgHiOAAoJEKllVAevmvmsGRsIAIMgm3tIcS9q4jY4Yjogl2+S
rGHvAxR2jkLFYTOH0zEkWiQyblYInhyLaoesmsTimlJxcMnRrgMf81oJp2+0Rihw
gQXeD5tvoq5G4lY8F4QAbo3SMrvpAE568ng8HG4w+m8ku/iQ2Lal0Dye/h1MEimX
jEyQfyetyP6wQUDaZjIdJpyvuKKfyYdq32ai89/nXiW2hw/fEEs+v3AhcFegOg0G
SOgOLyV8CVwouTl1PNPjyva/c44ufeJ8AKomiz+rYx6YfN8FpRAUS0PMTJgjBG45
SjxE39McuDNowXLoUwge8hVsEGqjo/9JM1jFR8n5UjjrUo86gmkvsCak170BUpg=
=swvs
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
