Description

WordPress Plugin Ad-Manager is prone to an open redirect vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow attackers to redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible. WordPress Plugin Ad-Manager version 1.1.2 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

http://tetraph.com/security/open-redirect/cve-2014-8754-wordpress-ad-manager-plugin-dest-redirect-privilege-escalation/

http://packetstormsecurity.com/files/129290/WordPress-Ad-Manager-1.1.2-Open-Redirect.html

http://seclists.org/fulldisclosure/2014/Nov/93

Related Vulnerabilities

AngularJS Improper Input Validation Vulnerability (CVE-2019-10768)

Apache HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2018-17189)

MySQL CVE-2016-0502 Vulnerability (CVE-2016-0502)

WordPress Plugin Schema App Structured Data Unspecified Vulnerability (0.5.4)

WordPress Plugin Google AdSense Click-Fraud Monitoring Cross-Site Scripting (1.8.6)

Severity

High

Classification

CVE-2014-8754 CWE-601 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Url Redirection