Description

WordPress Plugin Ad-Manager is prone to an open redirect vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow attackers to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress Plugin Ad-Manager version 1.1.2 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

http://tetraph.com/security/open-redirect/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/

http://packetstormsecurity.com/files/129290/WordPress-Ad-Manager-1.1.2-Open-Redirect.html

http://seclists.org/fulldisclosure/2014/Nov/93

Related Vulnerabilities

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2022-26595)

WordPress Plugin Contact Form Submissions Unspecified Vulnerability (1.6.3)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-2064)

PHP Other Vulnerability (CVE-2002-0121)

PostgreSQL Improper Input Validation Vulnerability (CVE-2019-10211)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Url Redirection CWE-601 CVE-2014-8754