Ultimate Member - User Profile / Membership Plugin um-actions-login.php cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in Ultimate Member - User Profile and Membership Plugin up to 2.0.27 on WordPress. Affected by this issue is some unknown functionality of the file includes/core/um-actions-login.php. The manipulation of the argument Primary button Text/Second button text results in cross site scripting. This vulnerability was named CVE-2018-17866. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Ultimate Member - User Profile and Membership Plugin up to 2.0.27 on WordPress (WordPress Plugin). Affected is some unknown functionality of the file includes/core/um-actions-login.php. The manipulation of the argument Primary button Text/Second button text with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.

The bug was discovered 10/24/2017. The weakness was presented 10/09/2018 (Website). The advisory is shared for download at wordpress.org. This vulnerability is traded as CVE-2018-17866 since 10/01/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 350 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:includes/core/um-actions-login.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.0.28 eliminates this vulnerability.

See VDB-117684, VDB-117685, VDB-117686 and VDB-117687 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Membership Plugin
• Ultimate Member - User Profile

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21
• 2.0.22
• 2.0.23
• 2.0.24
• 2.0.25
• 2.0.26
• 2.0.27

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion