« Volver al listado

CVE-2013-0731

Estado: ModificadaMedia (5)—

ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mailup — Wp-mailup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-0731",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-22T15:55:01.063",
  "references": [
    {
      "url": "http://osvdb.org/91274",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://plugins.trac.wordpress.org/changeset?new=682420",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/51917",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/58467",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://osvdb.org/91274",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://plugins.trac.wordpress.org/changeset?new=682420",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51917",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/58467",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82847",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie.  NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2."
    },
    {
      "lang": "es",
      "value": "ajax.functions.php en el complemento MailUp anterior a v1.3.3 para WordPress no restringe correctamente el acceso a las funciones especificadas Ajax, lo que permite a atacantes remotos modificar la configuración del complemento y realizar cross-site scripting (XSS) mediante el establecimiento de la cookie wordpress_logged_in. NOTA: esto se debe a una corrección incompleta de un problema similar que se fijó en v1.3.2."
    }
  ],
  "lastModified": "2026-06-16T23:49:58.243",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F57AAA05-C776-43FA-9B8E-896450DE5BBB",
              "versionEndIncluding": "1.3.2"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B340CF5F-EC94-4F1E-87B1-43998031DE6F"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9FE4AA1-06E0-47D8-8501-C58C6573E778"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5DAA7E0-A9B1-484E-95CC-509DC1DEBC65"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05BA2D74-AD47-48A8-9331-C145344FBAAC"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDA1B5EE-2C81-438E-827C-5FBB10C15BFA"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D3EE635-FC80-4202-AEF8-08F65DB470B0"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7714C1C-0C2E-4F42-A3D7-B70DD804E60C"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1A03224-76C4-40BB-B879-3EA0E9684A44"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D01C0A0D-EA5C-4D50-9CB0-7ABC9DD250FF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A77EB0E7-7FA7-4232-97DF-7C7587D163F1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}