Summary
This host is installed with WordPress WebEngage Plugin and is prone to cross site scripting vulnerability.
Impact
Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Impact Level: Application
Solution
Upgrade to version 2.0.1 or higher,
For updates refer to http://wordpress.org/plugins/webengage
Insight
Flaw exists as resize.php script does not validate input passed via the 'height' GET parameter before returning it to users.
Affected
WordPress WebEngage Plugin version 2.0.0
Detection
Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.
References
Severity
Classification
-
CVE CVE-2014-4574 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
- Apache Struts2 'XWork' Information Disclosure Vulnerability
- Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
- Apache ActiveMQ Multiple Vulnerabilities
- Adobe Presenter viewer.swf and loadflash.js XSS Vulnerability