CVE-2007-4014

Blix <= 0.9.1, Blixed <= 1.0, BlixKrieg <= 2.2 - Reflected Cross-Site Scripting

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en un cierto index.php en una secuencia de comandos de instalación relacionado con los temas (1) Blix 0.9.1, (2) Blixed 1.0, y (3) BlixKrieg (Blix Krieg) 2.2 para WordPress permite a atacantes remotos inyectar secuencias de comandos secuencias de comandos web o HMTL a través del parámetro s, posiblemente relacionado con un asunto relacionado con CVE-2007-2757. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros.

The Blix <= 0.9.1, Blixed <= 1.0, BlixKrieg <= 2.2 themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the 's' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This may be related to CVE-2007-2757.

*Credits: phoenix

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-07-18 CVE Published
2007-07-25 CVE Reserved
2024-08-07 CVE Updated
2024-09-20 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (9)

URL	Tag	Source
http://www.osvdb.org/37056	Vdb Entry
http://www.osvdb.org/37057	Vdb Entry
http://www.securityfocus.com/bid/24954	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35472	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35473	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35474	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/26109	2017-07-29
http://secunia.com/advisories/26115	2017-07-29
http://secunia.com/advisories/26116	2017-07-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Wordpress Search vendor "Wordpress"		Blix Search vendor "Wordpress" for product "Blix"				0.9.1 Search vendor "Wordpress" for product "Blix" and version "0.9.1"		-		Affected
Wordpress Search vendor "Wordpress"		Blixed Search vendor "Wordpress" for product "Blixed"				1.0 Search vendor "Wordpress" for product "Blixed" and version "1.0"		-		Affected
Wordpress Search vendor "Wordpress"		Blixkrieg Search vendor "Wordpress" for product "Blixkrieg"				2.2 Search vendor "Wordpress" for product "Blixkrieg" and version "2.2"		-		Affected