« Volver al listado

CVE-2017-1002020

Estado: ModificadaCrítica (9.8)—

Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Surveys Project — Surveys

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1002020",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "Binny V A",
          "product": "surveys",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.01.8",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-14T13:29:00.920",
  "references": [
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=193",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wordpress.org/plugins/surveys/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8833",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=193",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/surveys/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/8833",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el plugin surveys v1.01.8 en WordPress. El código en survey_form.php no sanitiza la variable action antes de incluirla dentro de una consulta SQL."
    }
  ],
  "lastModified": "2026-06-17T00:59:21.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:surveys_project:surveys:1.01.8:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11A73A23-A10A-4B00-835F-0D0E200871BD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}