Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Title Pluck SiteLife software multiple XSS vulnerabilities
Name VU#400619 First vendor Publication 2012-04-10
Vendor VU-CERT Last vendor Modification 2012-04-12
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Vulnerability Note VU#400619

Pluck SiteLife software multiple XSS vulnerabilities

Original Release date: 10 Apr 2012 | Last revised: 12 Apr 2012


Pluck SiteLife software contains multiple XSS vulnerabilities.


According to DemandMedia's website Pluck SiteLife software is an integrated community platform architected for brands. Pluck SiteLife software contains multiple cross site scripting (XSS) vulnerabilities.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

It has also has been reported that the cv, jsonRequest, r and ctk parameter could be vulnerable in some instances.


An attacker with access to the Pluck SiteLife software can conduct a cross site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.


Apply an Update

Pluck has stated that all affected customers have already been notified via email in regards to the new release and changelog documentation is available for customers who login to the Pluck Connect portal. Users are advised to upgrade to release 5.0.13 or later.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a Pluck SiteLife software using stolen credentials from a blocked network location.

Vendor Information

VendorStatusDate NotifiedDate Updated
PluckAffected03 Jan 201212 Apr 2012

CVSS Metrics (Learn More)



  • http://www.demandmedia.com/solutions/pluck/
  • http://www.pluck.com/products/
  • http://connect.pluck.com/
  • http://cwe.mitre.org/data/definitions/79.html


Thanks to Phil Purviance for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

  • CVE IDs:CVE-2012-0253
  • Date Public:10 Apr 2012
  • Date First Published:10 Apr 2012
  • Date Last Updated:12 Apr 2012
  • Document Revision:21


If you have feedback, comments, or additional information about this vulnerability, please send us email.

This product is provided subject to the Notification as indicated here: http://www.us-cert.gov/legal.html#notify

Original Source

Url : http://www.kb.cert.org/vuls/id/400619

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)