CVE-2013-5978 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cart66	Cart66 Lite Plugin

Configuration 1 [-]

cpe:2.3:a:cart66:cart66_lite_plugin:*:-:*:*:*:wordpress:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html
http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
http://seclists.org/bugtraq/2013/Oct/52
http://wordpress.org/plugins/cart66-lite/changelog
http://www.exploit-db.com/exploits/28959
http://www.securityfocus.com/bid/62977
https://exchange.xforce.ibmcloud.com/vulnerabilities/87873

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-12-11T18:36:56

Updated: 2024-08-06T17:29:42.383Z

Reserved: 2013-10-02T00:00:00

Link: CVE-2013-5978

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-12-11T19:15:12.670

Modified: 2024-11-21T01:58:32.250

Link: CVE-2013-5978

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-10-11T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-12-11T18:36:56", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}, {"tags": ["x_refsource_MISC"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html"}, {"tags": ["x_refsource_MISC"], "url": "http://seclists.org/bugtraq/2013/Oct/52"}, {"tags": ["x_refsource_MISC"], "url": "http://www.exploit-db.com/exploits/28959"}, {"tags": ["x_refsource_MISC"], "url": "http://wordpress.org/plugins/cart66-lite/changelog"}, {"tags": ["x_refsource_MISC"], "url": "http://www.securityfocus.com/bid/62977"}, {"tags": ["x_refsource_MISC"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2013-5978", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}, {"name": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html", "refsource": "MISC", "url": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html"}, {"name": "http://seclists.org/bugtraq/2013/Oct/52", "refsource": "MISC", "url": "http://seclists.org/bugtraq/2013/Oct/52"}, {"name": "http://www.exploit-db.com/exploits/28959", "refsource": "MISC", "url": "http://www.exploit-db.com/exploits/28959"}, {"name": "http://wordpress.org/plugins/cart66-lite/changelog", "refsource": "MISC", "url": "http://wordpress.org/plugins/cart66-lite/changelog"}, {"name": "http://www.securityfocus.com/bid/62977", "refsource": "MISC", "url": "http://www.securityfocus.com/bid/62977"}, {"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T17:29:42.383Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://seclists.org/bugtraq/2013/Oct/52"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.exploit-db.com/exploits/28959"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://wordpress.org/plugins/cart66-lite/changelog"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.securityfocus.com/bid/62977"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2013-5978", "datePublished": "2019-12-11T18:36:56", "dateReserved": "2013-10-02T00:00:00", "dateUpdated": "2024-08-06T17:29:42.383Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cart66:cart66_lite_plugin:*:-:*:*:*:wordpress:*:*", "matchCriteriaId": "68C0EF0D-C49B-4993-B35E-A7BC6EA61564", "versionEndIncluding": "1.5.1.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may only cross privilege boundaries if used in combination with CVE-2013-5977."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en el archivo products.php en el plugin Cart66 Lite versiones anteriores a 1.5.1.15 para WordPress, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de (1) nombre del producto o (2) campos de descripci\u00f3n de precio por medio de un petici\u00f3n a al archivo wp-admin/admin.php. NOTA: Este problema solo puede cruzar los l\u00edmites de privilegios si se utiliza en combinaci\u00f3n con CVE-2013-5977."}], "id": "CVE-2013-5978", "lastModified": "2024-11-21T01:58:32.250", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-11T19:15:12.670", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/bugtraq/2013/Oct/52"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "http://wordpress.org/plugins/cart66-lite/changelog"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://www.exploit-db.com/exploits/28959"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/62977"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/bugtraq/2013-10/0048.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/123587/WordPress-Cart66-1.5.1.14-Cross-Site-Request-Forgery-Cross-Site-Scripting.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/bugtraq/2013/Oct/52"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "http://wordpress.org/plugins/cart66-lite/changelog"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://www.exploit-db.com/exploits/28959"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/62977"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/87873"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}