Vulnerability Description
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Semperfiwebdesign | All In One Seo Pack | <= 2.2.5.1 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN75615300/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000046Vendor Advisory
- http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-releasPatchVendor Advisory
- http://jvn.jp/en/jp/JVN75615300/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000046Vendor Advisory
- http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-releasPatchVendor Advisory
FAQ
What is CVE-2015-0902?
CVE-2015-0902 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers...
How severe is CVE-2015-0902?
CVE-2015-0902 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-0902?
Check the references section above for vendor advisories and patch information. Affected products include: Semperfiwebdesign All In One Seo Pack.