CVE-2011-3860

Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/50334
https://sitewat.ch/en/Advisories/18	Exploit URL Repurposed

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:onedesigns:cover_wp::::::::
	cpe:2.3:a:onedesigns:cover_wp:1.1:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.2:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.3:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.4:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.4.1:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.1:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.2:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.3:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.4:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.5:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.6:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.7:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.8:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.5.9:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.6:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.6.1:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.6.2:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.6.3:::::::*
	cpe:2.3:a:onedesigns:cover_wp:1.6.4:::::::*

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

History

14 Feb 2024, 01:17

Type	Values Removed	Values Added
References	~~() https://sitewat.ch/en/Advisories/18 - Exploit~~	() https://sitewat.ch/en/Advisories/18 - Exploit, URL Repurposed

Information

Published : 2011-09-28 10:55

Updated : 2024-02-14 01:17

NVD link : CVE-2011-3860

Mitre link : CVE-2011-3860

CVE.ORG link : CVE-2011-3860

JSON object : View

Products Affected

onedesigns

cover_wp

wordpress

wordpress

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2011-3860", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2011-09-28T10:55:04.310", "references": [{"url": "http://www.securityfocus.com/bid/50334", "source": "cve@mitre.org"}, {"url": "https://sitewat.ch/en/Advisories/18", "tags": ["Exploit", "URL Repurposed"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter."}, {"lang": "es", "value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el tema Cover WP anteriores a v1.6.6 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro s."}], "lastModified": "2024-02-14T01:17:43.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:onedesigns:cover_wp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBAF6DCD-36B2-4E3A-AC3F-70C69ABFCF8D", "versionEndIncluding": "1.6.5"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8FFE575-197B-4642-AB1F-680EE28920BB"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86C4387E-53CD-4E92-BF3C-64412C68648C"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDB4E201-1B1A-44C6-B40C-2340967D0760"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C94FE880-326C-4EF3-99EA-AC73F9D37ABD"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C026683-D5F9-4376-8DBD-65EDBBB53051"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADDAB385-1559-44B6-909B-98F0E0AAA86E"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "207AB4EF-DDC2-4F33-87F4-029C01BC0C8B"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "927AB4AD-0B42-4873-B24F-D080784D1FD1"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF31D66A-D5A3-47C5-AAE7-76259364EA92"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3625724C-E183-4A8A-B5C4-FB0DBD959C8F"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DED329E2-852A-47CE-8AA0-D994DD604AD7"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ADC018F-975A-4B03-925C-3B592CFA39F4"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84409E5F-920C-4A97-95EE-27B4BD88850E"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D249FB37-9F3F-4AA6-9BE1-060EFF194A9D"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.5.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CF3F0E0-F6D7-4D50-9E07-8E24035C5569"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "281FFF4A-AC70-4DD4-A9DD-31486B992BC5"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A69140A4-E602-431C-B022-F6AD261D1093"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D521AC3E-80FA-46CA-A7B8-FB25608A9F74"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A67A96A-D0A6-4560-A282-E13179B825D6"}, {"criteria": "cpe:2.3:a:onedesigns:cover_wp:1.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDADF112-AF70-4363-8BE6-ECBF070DC732"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "847DA578-4655-477E-8A6F-99FBE738E4F9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}