What is CVE-2014-2838?

CVE-2014-2838 is a vulnerability in Dev4press Gd Star Rating, classified under Cross-Site Request Forgery (CSRF). Published 2015-01-12.

Is CVE-2014-2838 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Dev4press Gd Star Rating

CVE-2014-2838

Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.010 (59.7th percentile) — read the EPSS interpretation.

Affected products

Dev4press Gd_star_rating — versions 19.22
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)

Frequently asked questions

What is CVE-2014-2838?: CVE-2014-2838 is a vulnerability in Dev4press Gd Star Rating, classified under Cross-Site Request Forgery (CSRF). Published 2015-01-12.
Is CVE-2014-2838 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.