NVD

Id
36117  
Name
CVE-2014-9414  
Description
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-24  
Modified Date
2015-01-12  
Seq
2014-9414  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
184565 36117 CVE-2014-9414 http://mazinahmed1.blogspot.com/2014/12/w3-total-caches-w3totalfail.html  View
184566 36117 CVE-2014-9414 http://packetstormsecurity.com/files/129512/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.html  View
184567 36117 CVE-2014-9414 20141216 W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface  View
184568 36117 CVE-2014-9414 20141216 W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface  View
184569 36117 CVE-2014-9414 w3totalcache-wordpress-wpnonce-csrf(99352)  View
184570 36117 CVE-2014-9414 https://github.com/wp-plugins/w3-total-cache/commit/9a1cc9f70558282e135eb3120d271448c75b28dd#diff-86a10b31ab115483fe8111bedac14d15  View
184571 36117 CVE-2014-9414 https://wordpress.org/plugins/w3-total-cache/changelog/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18532 JVNDB-2014-007407 WordPress 用 W3 Total Cache プラグインにおけるクロスサイトリクエストフォージェリ攻撃を実行される脆弱性 WordPress 用 W3 Total Cache プラグインは、空のノンスを適切に処理しないため、クロスサイトリクエストフォージェリ攻撃を実行される、および管理者の認証をハイジャックされ、モバイルサイトのリダイレクト URI を変更される脆弱性が存在します。 CVE-2014-9414 76707 CVE-2014-9414 36117 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007407.html 2014-12-10 2015-01-05 View