Description

WordPress Plugin Ad-Manager is prone to an open redirect vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow attackers to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress Plugin Ad-Manager version 1.1.2 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

http://tetraph.com/security/open-redirect/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/

http://packetstormsecurity.com/files/129290/WordPress-Ad-Manager-1.1.2-Open-Redirect.html

http://seclists.org/fulldisclosure/2014/Nov/93

Related Vulnerabilities

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.26)

PostgreSQL Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-1899)

OpenSSL Improper Certificate Validation Vulnerability (CVE-2022-1343)

Dot CMS URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2018-17422)

MySQL CVE-2016-5633 Vulnerability (CVE-2016-5633)

Severity

High

Classification

CVE-2014-8754 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Url Redirection