CVE-2014-5347 Disqus Comment System < 2.76 - Cross-Site Request Forgery
MediumCVSS 6.8
EPSS 4.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| disqus comment system | <= 2.75 | No fix listed |
| disqus comment system | = 2.40 | No fix listed |
| disqus comment system | = 2.41 | No fix listed |
| disqus comment system | = 2.42 | No fix listed |
| disqus comment system | = 2.43 | No fix listed |
| disqus comment system | = 2.44 | No fix listed |
| disqus comment system | = 2.45 | No fix listed |
| disqus comment system | = 2.46 | No fix listed |
| disqus comment system | = 2.47 | No fix listed |
| disqus comment system | = 2.48 | No fix listed |
| disqus comment system | = 2.49 | No fix listed |
| disqus comment system | = 2.50 | No fix listed |
| disqus comment system | = 2.51 | No fix listed |
| disqus comment system | = 2.52 | No fix listed |
| disqus comment system | = 2.53 | No fix listed |
| disqus comment system | = 2.54 | No fix listed |
| disqus comment system | = 2.55 | No fix listed |
| disqus comment system | = 2.60 | No fix listed |
| disqus comment system | = 2.61 | No fix listed |
| disqus comment system | = 2.62 | No fix listed |
| disqus comment system | = 2.63 | No fix listed |
| disqus comment system | = 2.64 | No fix listed |
| disqus comment system | = 2.65 | No fix listed |
| disqus comment system | = 2.66 | No fix listed |
| disqus comment system | = 2.67 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| disqus comment system | = 2.68 | No fix listed |
| disqus comment system | = 2.69 | No fix listed |
| disqus comment system | = 2.70 | No fix listed |
| disqus comment system | = 2.71 | No fix listed |
| disqus comment system | = 2.72 | No fix listed |
| disqus comment system | = 2.73 | No fix listed |
| disqus comment system | = 2.74 | No fix listed |
| wordpress disqus-comment-system(WordPress) | < 2.76 | 2.76 |
References
- packetstormsecurity.com
- packetstormsecurity.com exploit
- 20140812 Multiple Vulnerabilities in Disqus for Wordpress v2.7.5 mailing-list
- 34336 exploit
- 69205 vdb-entry
- disqus-wordpress-manage-csrf(95288) vdb-entry
- disqus-wordpress-nonce-sec-bypass(95289) vdb-entry
- gist.github.com
- wordpress.org patch
- www.nikcub.com exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org