CVE-2014-4539

MEDIUMNuclei

Movies <= 0.6 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2014-4539 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMMovies <= 0.6 - Cross-Site ScriptingCVSS 6.1

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of the Movies plugin (version 0.7 or above) that addresses the XSS vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2014cvewordpresswp-pluginxsswpscanunauthmovies_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:movies_project:movies:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d6ea4fe6-c486-415d-8f6d-57ea2f149304 https://nvd.nist.gov/vuln/detail/CVE-2014-4539 http://codevigilant.com/disclosure/wp-plugin-movies-a3-cross-site-scripting-xss https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2