Unscored severity · published May 22, 2014
CVE-2014-3845
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified…
–
CVSS
1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Color Picker · Tinymce
through 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3845
secunia.com
http://secunia.com/advisories/58095
wordpress.org
http://wordpress.org/plugins/tinymce-colorpicker/changelog
More from Color Picker
–
CVE-2014-3844
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors