CVE-2014-4030
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://wordpress.org/plugins/jw-player-plugin-for-wordpress/changelog
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | {"endIncluding":"2.1.3"} | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.0 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.1 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.2 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.3 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.4 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.0.5 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.1.0 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.1.1 | |
| longtailvideo | jw_player_for_flash_\&_html5_video_plugin | 2.1.2 | |
References
- http://seclists.org/fulldisclosure/2014/Jun/64
- http://secunia.com/advisories/59173
- http://wordpress.org/plugins/jw-player-plugin-for-wordpress/changelog
- https://security.dxw.com/advisories/jw-player-for-flash-html5-video/
- http://seclists.org/fulldisclosure/2014/Jun/64
- http://secunia.com/advisories/59173
- http://wordpress.org/plugins/jw-player-plugin-for-wordpress/changelog
- https://security.dxw.com/advisories/jw-player-for-flash-html5-video/
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.