Refine your search

2 vulnerabilities found for TablePress by tablepress.org

CVE-2017-10889 (GCVE-0-2017-10889)
Vulnerability from cvelistv5
Published
2017-11-17 14:00
Modified
2024-08-05 17:50
Severity ?
CWE
  • XML external entities (XXE)
Summary
TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
References
Impacted products
Vendor Product Version
tablepress.org TablePress Version: prior to version 1.8.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/tablepress/#developers"
          },
          {
            "name": "JVN#05398317",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN05398317/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TablePress",
          "vendor": "tablepress.org",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 1.8.1"
            }
          ]
        }
      ],
      "datePublic": "2017-11-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML external entities (XXE)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-17T13:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/plugins/tablepress/#developers"
        },
        {
          "name": "JVN#05398317",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN05398317/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10889",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TablePress",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to version 1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "tablepress.org"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "XML external entities (XXE)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wordpress.org/plugins/tablepress/#developers",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/plugins/tablepress/#developers"
            },
            {
              "name": "JVN#05398317",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN05398317/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10889",
    "datePublished": "2017-11-17T14:00:00.000Z",
    "dateReserved": "2017-07-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:50:12.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2017-000236
Vulnerability from jvndb
Published
2017-11-14 13:26
Modified
2018-03-07 13:36
Severity ?
5.0 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Summary
WordPress plugin "TablePress" vulnerable to improper restriction of XML external entity (XXE) references
Details
The WordPress plugin "TablePress" is a plugin to create and manage tables on WordPress site. TablePress contains a vulnerability where XML external entity (XXE) references are not properly restricted (CWE-611). Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000236.html",
  "dc:date": "2018-03-07T13:36+09:00",
  "dcterms:issued": "2017-11-14T13:26+09:00",
  "dcterms:modified": "2018-03-07T13:36+09:00",
  "description": "The WordPress plugin \"TablePress\" is a plugin to create and manage tables on WordPress site. TablePress contains a vulnerability where XML external entity (XXE) references are not properly restricted (CWE-611).\r\n\r\nYuji Tounai of NTT Communications Corporation reported this vulnerability to IPA.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000236.html",
  "sec:cpe": {
    "#text": "cpe:/a:tablepress:tablepress",
    "@product": "TablePress",
    "@vendor": "tablepress.org",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2017-000236",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN05398317/index.html",
      "@id": "JVN#05398317",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10889",
      "@id": "CVE-2017-10889",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-10889",
      "@id": "CVE-2017-10889",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "WordPress plugin \"TablePress\" vulnerable to improper restriction of XML external entity (XXE) references"
}