Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 24/12/2014 Updated: 26/05/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The W3 Total Cache plugin prior to 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote malicious users to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
boldgrid w3 total cache

CWE-352 http://packetstormsecurity.com/files/129512/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.html https://github.com/wp-plugins/w3-total-cache/commit/9a1cc9f70558282e135eb3120d271448c75b28dd#diff-86a10b31ab115483fe8111bedac14d15 http://seclists.org/fulldisclosure/2014/Dec/67 http://mazinahmed1.blogspot.com/2014/12/w3-total-caches-w3totalfail.html http://secunia.com/advisories/61562 https://wordpress.org/plugins/w3-total-cache/changelog/https://exchange.xforce.ibmcloud.com/vulnerabilities/99352 http://www.securityfocus.com/archive/1/534250/100/0/threaded https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-9414

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect