漏洞标题
Greenshift - animation and page builder blocks <= 9.0.0 版本存在授权不足以及服务器端请求伪造和存储型跨站脚本漏洞
漏洞描述信息
WordPress使用的Greenshift - 动画和页面构建块插件在所有版本（包括9.0.0版本）中存在认证（订阅者+）服务端请求伪造（SSRF）和存储型跨站脚本（XSS）漏洞。这是由于在greenshift_download_file_localy函数中缺少能力检查，同时上传的SVG文件也缺乏SSRF防护和净化处理。这使得具有订阅者级别及以上权限的认证攻击者能够从Web应用程序发起针对任意位置的Web请求，并且可以利用该漏洞下载包含跨站脚本载荷的恶意SVG文件到服务器上。对于云服务器，攻击者还可以获取实例元数据。该问题在8.9.9版本中部分修复，并在9.0.1版本中完全修复。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
漏洞类别
服务端请求伪造(SSRF)
漏洞标题
Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting
漏洞描述信息
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
漏洞类别
授权机制缺失
漏洞标题
WordPress plugin Greenshift 安全漏洞
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Greenshift 9.0.0版本及之前版本存在安全漏洞，该漏洞源于经过身份验证的服务器端请求伪造和存储型跨站脚本。
CVSS信息
N/A
漏洞类别
其他
