Nixpkgs security tracker
7.2 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): High (H)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): High (H)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
References
-
https://wpscan.com/vulnerability/f0380d89-6e49-462a-b158-9d2cc3f049ca/ exploitvdb-entrytechnical-description
Affected products
- <4.1.18
Matching in nixpkgs
pkgs.cmph
Free minimal perfect hash C library, providing several algorithms in the literature in a consistent, ease to use, API
pkgs.dtcmp
MPI datatype comparison library
pkgs.ncmpc
Curses-based interface for MPD (music player daemon)
pkgs.rnxcmp
Compression/restoration of RINEX observation files developed by Y. Hatanaka of GSI
pkgs.critcmp
Command line tool for comparing benchmarks run by Criterion
pkgs.fstrcmp
Make fuzzy comparisons of strings and byte arrays
pkgs.ncmpcpp
Featureful ncurses based MPD client inspired by ncmpc
pkgs.scmpuff
Numeric file shortcuts for common git commands
pkgs.cargo-benchcmp
Small utility to compare Rust micro-benchmarks
pkgs.pkgsRocm.dtcmp
MPI datatype comparison library
pkgs.vimPlugins.nvim-cmp
A completion plugin for neovim
-
nixos-unstable 1-unstable-scm-1
- nixpkgs-unstable 1-unstable-scm-1
- nixos-unstable-small 1-unstable-scm-1
-
nixos-26.05 1-unstable-scm-1
- nixos-26.05-small 1-unstable-scm-1
- nixpkgs-26.05-darwin 1-unstable-scm-1
pkgs.luaPackages.nvim-cmp
A completion plugin for neovim
pkgs.vimPlugins.blink-cmp
Performant, batteries-included completion plugin for Neovim
pkgs.haskellPackages.funcmp
Functional MetaPost is a Haskell frontend to the MetaPost language
pkgs.lua51Packages.nvim-cmp
A completion plugin for neovim
pkgs.lua52Packages.nvim-cmp
A completion plugin for neovim
pkgs.lua53Packages.nvim-cmp
A completion plugin for neovim
pkgs.luajitPackages.nvim-cmp
A completion plugin for neovim
pkgs.python313Packages.icmplib
Python implementation of the ICMP protocol
pkgs.python314Packages.icmplib
Python implementation of the ICMP protocol
pkgs.haskellPackages.socket-icmp
Definitions for using ICMP with the `socket` library
Package maintainers
-
@JarvisCraft Petr Portnov <mrjarviscraft+nix@gmail.com>
-
@markuskowa Markus Kowalewski <markus.kowalewski@gmail.com>
-
@sephalon Stefan Wiehler <me@sephalon.net>
-
@peti Peter Simons <simons@cryp.to>
-
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
-
@k0ral Koral <koral@mailoo.org>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@Luflosi Luflosi <luflosi@luflosi.de>
-
@christoph-heiss Christoph Heiss <christoph@c8h4.io>
-
@cpcloud Phillip Cloud
-
@redxtech Gabe Dunn <gabe@gabedunn.dev>
-
@Balssh George Bals <george.bals25@gmail.com>
-
@llakala llakala <elevenaka11@gmail.com>