CVE-2014-8607

The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/	Exploit
http://www.vapid.dhs.org/advisory.php?v=110	Exploit
http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/	Exploit
http://www.vapid.dhs.org/advisory.php?v=110	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xcloner:xcloner:3.1.1:::::wordpress::
	cpe:2.3:a:xcloner:xcloner:3.5.1:::::joomla\!::

History

No history.

Information

Published : 2015-06-10 18:59

Updated : 2025-04-12 10:46

NVD link : CVE-2014-8607

Mitre link : CVE-2014-8607

CVE.ORG link : CVE-2014-8607

JSON object : View

Products Affected

xcloner

xcloner

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-8607", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-06-10T18:59:04.753", "references": [{"url": "http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vapid.dhs.org/advisory.php?v=110", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vapid.dhs.org/advisory.php?v=110", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command."}, {"lang": "es", "value": "El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! proporciona el nombre de usuario y la contrase\u00f1a de MySQL en la l\u00ednea de comando, lo que permite a usuarios locales obtener informaci\u00f3n sensible a trav\u00e9s de el comando ps."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xcloner:xcloner:3.1.1:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "94299BFC-3053-4D5C-8D02-96DB0C6A0875"}, {"criteria": "cpe:2.3:a:xcloner:xcloner:3.5.1:*:*:*:*:joomla\\!:*:*", "vulnerable": true, "matchCriteriaId": "ED77BB25-1C5C-4786-97C8-576215194DCF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}