« Volver al listado

CVE-2015-2293

Estado: ModificadaMedia (6.8)—

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yoast — Wordpress SEO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2293",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-03-17T15:59:01.847",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1031920",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/7841",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://yoast.com/wordpress-seo-security-release/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2015/Mar/73",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1031920",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/wordpress-seo/changelog/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpvulndb.com/vulnerabilities/7841",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://yoast.com/wordpress-seo-security-release/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades cross-site request forgery (CSRF) en admin/class-bulk-editor-list-table.php en WordPress SEO en el plugin Yoast anterior a 1.5.7, 1.6.x anterior a 1.6.4, y 1.7.x anterior a 1.7.4 de WordPress permite a atacantes remotos secuestrar la autenticación de ciertos usuarios en las peticiones que conllevan ataques de inyección SQL a través de (1) order_by o (2) parámetro order en la página wpseo_bulk-editor"
    }
  ],
  "lastModified": "2026-06-17T00:23:52.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFD2D356-0447-4EE8-823D-0500E8496870",
              "versionEndIncluding": "1.5.6"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.0:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F19DB4E-EB9B-405E-8C7D-0A7273CEE779"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.1:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58918158-0AEF-4DDB-8B95-56739C5F99CC"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.2:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FACBDE2-D9F4-4330-9D5E-0336F130D1C5"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.6.3:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "597D08B2-E58E-4AC4-B1F9-660015506A7C"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.1:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84FDF198-8B7E-431A-802E-9EC6A23BAB96"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.2:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C4468DC-91D8-4AB8-9C13-A826E9AB50C4"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B87AD79A-90D0-42FB-BA9B-F0E25F44A797"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.1:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86C6AA39-810E-4688-991F-4B17672C6FCF"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.2:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7762119-2B03-4B0D-B19A-42C6A74DBCAB"
            },
            {
              "criteria": "cpe:2.3:a:yoast:wordpress_seo:1.7.3.3:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63AEC8FD-F526-4BB3-BE1D-37B45D7B7F2B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}