On this page

Atomicorp WAF Rule 323667

Rule Summary

  • Rule ID: 323667
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: WP XSS in Loginizer attack (CVE-2018-11366)
  • Observed CWEs: None documented
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request arguments, JSON request data, SOAP request data
  • Rule action: pass
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: WP XSS in Loginizer attack (CVE-2018-11366)” in the request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and records the match without a disruptive action.

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2018-11366

init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.