NVD Vulnerability Detail

CVE-2020-13426

Summary	The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
Publication Date	June 23, 2020, 3:15 a.m.
Registration Date	Jan. 26, 2021, 11:52 a.m.
Last Update	Nov. 21, 2024, 2:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:bdtask:multi-scheduler:1.0.0:::::wordpress::

Related information, measures and tools

No	URL	タグ
1	https://0day.today/exploit/34496	Broken Link
2	https://cxsecurity.com/issue/WLB-2020050235	Exploit Third Party Advisory
3	https://infayer.com/archivos/448	Exploit Third Party Advisory
4	https://packetstormsecurity.com/files/157867/WordPress-Multi-Scheduler-1.0.0-Cross-Site-Request-Forgery.html	Exploit Third Party Advisory VDB Entry
5	https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user	Exploit Third Party Advisory
6	https://twitter.com/UnD3sc0n0c1d0	Third Party Advisory
7	https://wordpress.org/plugins/multi-scheduler/#developers	Product Third Party Advisory
8	https://www.exploit-db.com/exploits/48532	Exploit Third Party Advisory VDB Entry
9	https://0day.today/exploit/34496	Broken Link
10	https://www.exploit-db.com/exploits/48532	Exploit Third Party Advisory VDB Entry
11	https://wordpress.org/plugins/multi-scheduler/#developers	Product Third Party Advisory
12	https://twitter.com/UnD3sc0n0c1d0	Third Party Advisory
13	https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user	Exploit Third Party Advisory
14	https://packetstormsecurity.com/files/157867/WordPress-Multi-Scheduler-1.0.0-Cross-Site-Request-Forgery.html	Exploit Third Party Advisory VDB Entry
15	https://infayer.com/archivos/448	Exploit Third Party Advisory
16	https://cxsecurity.com/issue/WLB-2020050235	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

WordPress 用 Multi-Scheduler プラグインにおけるクロスサイトリクエストフォージェリの脆弱性

Title	WordPress 用 Multi-Scheduler プラグインにおけるクロスサイトリクエストフォージェリの脆弱性
Summary	WordPress 用 Multi-Scheduler プラグインには、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 21, 2020, midnight
Registration Date	July 28, 2020, 11:38 a.m.
Last Update	July 28, 2020, 11:38 a.m.

Affected System

bdtask

Multi-Scheduler 1.0.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-13426	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13426
National Vulnerability Database (NVD)
2	CVE-2020-13426	https://nvd.nist.gov/vuln/detail/CVE-2020-13426

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
WordPress Plugin Directory
1	multi-scheduler	https://wordpress.org/plugins/multi-scheduler/#developers

その他

No	Name	URL
関連文書
1	WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)	https://research-labs.net/search/exploits/wordpress-plugin-multi-scheduler-100-cross-site-request-forgery-delete-user

Change Log

No	Changed Details	Date of change
1	[2020年07月28日] 掲載	July 28, 2020, 11:38 a.m.