JVNDB-2017-000050

[Japanese]
JVNDB-2017-000050
WordPress plugin "YOP Poll" vulnerable to cross-site scripting
Overview
The WordPress plugin "YOP Poll" contains a stored cross-site scripting (CWE-79) vulnerability. Sho Ueshima, Takashi Honda, Tsuyoshi Ogawa and Minaho Umehara of SIE Co.,Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 5.4 (Medium) [IPA Score] Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None CVSS V2 Severity: Base Metrics 4.0 (Medium) [IPA Score] Access Vector: Network Access Complexity: Low Authentication: Single Instance Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
Affected Products

YOP YOP Poll versions prior to 5.8.1

Impact
An arbitrary script may be executed on the web browser of a user accessing the poll generated by the application.
Solution
[Update the plugin] Update the plugin according to the information provided by the developer.
Vendor Information
YOP YOP Poll : WordPress Plugins - YOP Poll - Changelog YOP Poll : Changeset 1608599 for yop-poll/trunk/models/custom_field_model.php YOP Poll : Changeset 1608599 for yop-poll/trunk/models/question_model.php
CWE (What is CWE?)
Cross-site Scripting(CWE-79) [IPA Evaluation]
CVE (What is CVE?)
CVE-2017-2127
References
JVN : JVN#55294532 National Vulnerability Database (NVD) : CVE-2017-2127
Revision History
[2017/03/23] Web page was published [2017/06/01] References : Content was added


Date Public	2017/03/23
Date First Published	2017/03/23
Date Last Updated	2017/06/01

WordPress plugin "YOP Poll" vulnerable to cross-site scripting