WordPress BP Group Documents Plugin Multiple Security Vulnerabilities

Bugtraq ID:	65639
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 19 2014 12:00AM
Updated:	Feb 19 2014 12:00AM
Credit:	Tom Adams
Vulnerable:
Not Vulnerable:

WordPress BP Group Documents Plugin Multiple Security Vulnerabilities

BP Group Documents plugin for WordPress is prone to the following vulnerabilities:

1. A security-bypass vulnerability
2. Multiple HTML-injection vulnerabilities
3. Multiple cross-site request forgery vulnerabilities
4. Multiple cross-site scripting vulnerabilities

An attacker can exploit these issues to perform unauthorized actions, bypass security restrictions, execute attacker-supplied HTML or JavaScript code in the context of the affected site, to steal cookie-based authentication credentials or gain access to sensitive information.

BP Group Documents 1.2.1 is vulnerable; other versions may also be affected.

WordPress BP Group Documents Plugin Multiple Security Vulnerabilities

Attackers can exploit this issue using a browser or readily available tools.

WordPress BP Group Documents Plugin Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress BP Group Documents Plugin Multiple Security Vulnerabilities

References: