NVD

Id
36326  
Name
CVE-2014-9735  
Description
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-06-30  
Modified Date
2016-11-28  
Seq
2014-9735  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185837 36326 CVE-2014-9735 20151125 Slider Revolution/Showbiz Pro shell upload exploit  View
185838 36326 CVE-2014-9735 71306  View
185839 36326 CVE-2014-9735 http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/  View
185840 36326 CVE-2014-9735 https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html  View
185841 36326 CVE-2014-9735 https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php  View
185842 36326 CVE-2014-9735 https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/  View
185843 36326 CVE-2014-9735 https://wpvulndb.com/vulnerabilities/7954  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19213 JVNDB-2014-008090 Wordpress 用 ThemePunch Slider Revolution プラグインおよび Showbiz Pro プラグインにおける任意のファイルをアップロードされる脆弱性 Wordpress 用 ThemePunch Slider Revolution (revslider) プラグインおよび Showbiz Pro プラグインは、管理者の AJAX 機能へのアクセスを適切に制限しないため、以下の脆弱性が存在します。 CVE-2014-9735 77028 CVE-2014-9735 36326 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008090.html 2014-11-25 2015-07-02 View