Description

WordPress Plugin Ad-Manager is prone to an open redirect vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow attackers to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress Plugin Ad-Manager version 1.1.2 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

http://tetraph.com/security/open-redirect/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/

http://packetstormsecurity.com/files/129290/WordPress-Ad-Manager-1.1.2-Open-Redirect.html

http://seclists.org/fulldisclosure/2014/Nov/93

Related Vulnerabilities

SharePoint CVE-2021-40483 Vulnerability (CVE-2021-40483)

PHP Out-of-bounds Read Vulnerability (CVE-2017-11147)

WordPress Plugin Far Future Expiry Header Cross-Site Request Forgery (1.4)

MySQL CVE-2019-2584 Vulnerability (CVE-2019-2584)

Oracle Database Server CVE-2015-2629 Vulnerability (CVE-2015-2629)

Severity

High

Classification

CVE-2014-8754 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Url Redirection