CVE-2012-4271 Bad Behavior < 2.0.47 & 2.2.0 - 2.2.4 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3) httpbl_maxage, (4) httpbl_threat, (5) reverse_proxy_addresses, or (6) reverse_proxy_header parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mark Jaquith bad behavior | <= 2.0.46 | No fix listed |
| Mark Jaquith bad behavior | = 2.2.0 | No fix listed |
| Mark Jaquith bad behavior | = 2.2.1 | No fix listed |
| Mark Jaquith bad behavior | = 2.2.2 | No fix listed |
| Mark Jaquith bad behavior | = 2.2.3 | No fix listed |
| Mark Jaquith bad behavior | = 2.2.4 | No fix listed |
| WordPress | All versions | No fix listed |
| wordpress bad-behavior(WordPress) | < 2.0.47 | 2.0.47 |
| wordpress bad-behavior(WordPress) | >= 2.2.0, < 2.2.5 | 2.2.5 |
References
- packetstormsecurity.org
- plugins.trac.wordpress.org exploit patch
- 53477 vdb-entry
- badbehavior-optionsgeneral-xss(75521) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org