« Volver al listado

CVE-2013-2640

Estado: ModificadaMedia (5)—

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mailup — Wp-mailup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-2640",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-22T17:55:01.097",
  "references": [
    {
      "url": "http://osvdb.org/91274",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://plugins.trac.wordpress.org/changeset?new=682420",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/51917",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/91274",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://plugins.trac.wordpress.org/changeset?new=682420",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/51917",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wordpress.org/extend/plugins/wp-mailup/changelog/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to \"formData=save\" requests, a different version than CVE-2013-0731."
    },
    {
      "lang": "es",
      "value": "ajax.functions.php en el complemento MailUp anterior a v1.3.2 para WordPress no restringe correctamente el acceso a las funciones especificadas Ajax, que permite a atacantes remotos modificar la configuración del complemento y conducir a ataques de cross-site scripting (XSS) a través de vectores no especificados relacionados con \"formData=save\" las solicitudes, una versión diferente de CVE-2013-0731."
    }
  ],
  "lastModified": "2026-06-16T23:53:45.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58E8708A-0A57-463B-9EA0-82FFD585507F",
              "versionEndIncluding": "1.3.1"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B340CF5F-EC94-4F1E-87B1-43998031DE6F"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9FE4AA1-06E0-47D8-8501-C58C6573E778"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5DAA7E0-A9B1-484E-95CC-509DC1DEBC65"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05BA2D74-AD47-48A8-9331-C145344FBAAC"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDA1B5EE-2C81-438E-827C-5FBB10C15BFA"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D3EE635-FC80-4202-AEF8-08F65DB470B0"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7714C1C-0C2E-4F42-A3D7-B70DD804E60C"
            },
            {
              "criteria": "cpe:2.3:a:mailup:wp-mailup:1.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D01C0A0D-EA5C-4D50-9CB0-7ABC9DD250FF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A77EB0E7-7FA7-4232-97DF-7C7587D163F1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}