NVD Vulnerability Detail

CVE-2015-9230

Summary	In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
Publication Date	Sept. 13, 2017, 7:29 a.m.
Registration Date	Jan. 26, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 11:40 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:ait-pro:bulletproof_security:.52.4:::::wordpress::

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2015/10/27/3	Exploit Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2015/10/27/3	Exploit Mailing List Third Party Advisory
3	https://cxsecurity.com/issue/WLB-2016010011	Exploit Third Party Advisory
4	https://cxsecurity.com/issue/WLB-2016010011	Exploit Third Party Advisory
5	https://cybersecurityworks.com/zerodays/cve-2015-9230-bulletproof.html	Exploit Third Party Advisory
6	https://cybersecurityworks.com/zerodays/cve-2015-9230-bulletproof.html	Exploit Third Party Advisory
7	https://forum.ait-pro.com/forums/topic/bps-changelog/	Third Party Advisory
8	https://forum.ait-pro.com/forums/topic/bps-changelog/	Third Party Advisory
9	https://github.com/cybersecurityworks/Disclosed/issues/3	Exploit Third Party Advisory
10	https://github.com/cybersecurityworks/Disclosed/issues/3	Exploit Third Party Advisory
11	https://packetstormsecurity.com/files/135125/BulletProof-Security-.52.4-Cross-Site-Scripting.html	Exploit Third Party Advisory VDB Entry
12	https://packetstormsecurity.com/files/135125/BulletProof-Security-.52.4-Cross-Site-Scripting.html	Exploit Third Party Advisory VDB Entry
13	https://wpvulndb.com/vulnerabilities/8224	Third Party Advisory
14	https://wpvulndb.com/vulnerabilities/8224	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

WordPress 用 BulletProof Security プラグインにおけるクロスサイトスクリプティングの脆弱性

Title	WordPress 用 BulletProof Security プラグインにおけるクロスサイトスクリプティングの脆弱性
Summary	WordPress 用 BulletProof Security プラグインには、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 9, 2015, midnight
Registration Date	Oct. 10, 2017, 4:02 p.m.
Last Update	Oct. 10, 2017, 4:02 p.m.

Affected System

AITpro

BulletProof Security .52.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-9230	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9230
National Vulnerability Database (NVD)
2	CVE-2015-9230	https://nvd.nist.gov/vuln/detail/CVE-2015-9230

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
AITpro
1	BPS Changelog\|Whats New	https://forum.ait-pro.com/forums/topic/bps-changelog/
WordPress Plugin Directory
2	BulletProof Security	https://wordpress.org/plugins/bulletproof-security/#changelog

その他

No	Name	URL
関連文書
1	XSS Vulnerability in BulletProof Security Version .52.4 #3	https://github.com/cybersecurityworks/Disclosed/issues/3

Change Log

No	Changed Details	Date of change
0	[2017年10月10日] 掲載	Feb. 17, 2018, 10:37 a.m.