CVE-2013-4954

CVSS V2 Low 2.6 CVSS V3 None
Description
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
Overview
  • CVE ID
  • CVE-2013-4954
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2013-07-29T23:27:50
  • Last Modified Date
  • 2017-08-29T01:33:41
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:genetechsolutions:pie-register:*:*:*:*:*:*:*:* 1 OR 1.30
cpe:2.3:a:genetechsolutions:pie-register:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.1.9:a:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.8:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.9:a:*:*:*:*:*:* 1 OR
cpe:2.3:a:genetechsolutions:pie-register:1.2.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:H/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • HIGH
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 2.6
  • Severity
  • LOW
  • Exploitability Score
  • 4.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-register Exploit Patch
http://osvdb.org/95160
http://secunia.com/advisories/54123 Vendor Advisory
http://wordpress.org/support/topic/security-issue-web-application-cross-site-scripting
http://wordpress.org/plugins/pie-register/changelog/
http://www.securityfocus.com/bid/61140 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/85604
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2013-4954
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4954
History
Created Old Value New Value Data Type Notes
2022-05-10 08:45:45 Added to TrackCVE
2022-12-01 19:11:49 2013-07-29T23:27Z 2013-07-29T23:27:50 CVE Published Date updated
2022-12-01 19:11:49 2017-08-29T01:33:41 CVE Modified Date updated
2022-12-01 19:11:49 Modified Vulnerability Status updated