{"id":2654,"date":"2014-06-02T18:52:22","date_gmt":"2014-06-02T22:52:22","guid":{"rendered":"http:\/\/blog.funio.com\/fr\/?p=2654"},"modified":"2014-06-02T18:52:30","modified_gmt":"2014-06-02T22:52:30","slug":"vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack","status":"publish","type":"post","link":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/","title":{"rendered":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb"},"content":{"rendered":"

Les passionn\u00e9s de la s\u00e9curit\u00e9 chez Sucuri ont trouv\u00e9 deux failles importantes dans la s\u00e9curit\u00e9 du tr\u00e8s populaire module WordPress \u00ab\u00a0All In One SEO Pack<\/a>\u00a0\u00bb. Effectivement, avec plus de 18 millions de t\u00e9l\u00e9chargements, nous croyons que tout utilisateur WordPress devrait \u00eatre au courant de cette situation.<\/p>\n

Ces br\u00e8ches de s\u00e9curit\u00e9 permettraient aux attaquants d\u2019acc\u00e9der \u00e0 des comptes utilisateur n\u2019ayant pas des acc\u00e8s administratifs (utilisateur, auteur et autres non-administrateurs), d\u2019\u00e9lever leurs privil\u00e8ges et d\u2019injecter du code malicieux dans le panneau de contr\u00f4le administratif.<\/p>\n

Soyez rassur\u00e9, l\u2019\u00e9quipe qui a cr\u00e9\u00e9 le module en question a d\u00e9j\u00e0 mis disponible un \u00ab\u00a0patch\u00a0\u00bb qui corrige ce probl\u00e8me.<\/p>\n

Marc-Alexandre Montpas, auteur de l\u2019article portant sur ce sujet sur le blogue de Sucuri<\/a>, explique plus en d\u00e9tail comment une personne malintentionn\u00e9e pourrait utiliser ces failles et cr\u00e9er une escalade des privil\u00e8ges d\u2019un utilisateur n\u2019ayant pas de droits administratifs.<\/p>\n

Les r\u00e9percussions de ces failles peuvent \u00eatre tant au niveau de son classement dans les engins de recherche (SEO et SERP), mais peut aussi affecter le site WordPress en question en permettant du \u00ab\u00a0cross site scripting (XSS)\u00a0\u00bb.<\/p>\n

Comment pr\u00e9venir le probl\u00e8me\u2009?<\/h2>\n

Aussi simple que de faire la mise \u00e0 jour du module! \u00c0 partir de votre panneau de contr\u00f4le administratif WordPress, rendez-vous \u00e0 la section des (plug-ins) et s\u00e9lectionnez le module \u00ab\u00a0All in One SEO Pack\u00a0\u00bb. Dans le menu d\u00e9roulant (au haut ou au bas de la page) s\u00e9lectionnez l\u2019option de mise \u00e0 jour. Le syst\u00e8me devrait automatiquement aller r\u00e9cup\u00e9rer la derni\u00e8re version disponible pour vous automatiquement.<\/p>\n

Pour \u00eatre certain que tout est en ordre, regardez les d\u00e9tails du module et assurez-vous d\u2019avoir la derni\u00e8re version du module (actuellement 2.1.6).<\/p>\n","protected":false},"excerpt":{"rendered":"

Les passionn\u00e9s de la s\u00e9curit\u00e9 chez Sucuri ont trouv\u00e9 deux failles importantes dans la s\u00e9curit\u00e9 du tr\u00e8s populaire module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb. Effectivement, avec plus de 18 millions de t\u00e9l\u00e9chargements, nous croyons que tout utilisateur WordPress devrait \u00eatre au courant de cette situation. Ces br\u00e8ches de s\u00e9curit\u00e9 permettraient aux attaquants d\u2019acc\u00e9der \u00e0 […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[7,88,22,120],"class_list":["post-2654","post","type-post","status-publish","format-standard","hentry","category-funio","tag-default","tag-httpmedia-funio-comimageskbblogwordpress-logo-png","tag-securite","tag-wordpress"],"yoast_head":"\nVuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog\" \/>\n<meta property=\"og:description\" content=\"Les passionn\u00e9s de la s\u00e9curit\u00e9 chez Sucuri ont trouv\u00e9 deux failles importantes dans la s\u00e9curit\u00e9 du tr\u00e8s populaire module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb. Effectivement, avec plus de 18 millions de t\u00e9l\u00e9chargements, nous croyons que tout utilisateur WordPress devrait \u00eatre au courant de cette situation. Ces br\u00e8ches de s\u00e9curit\u00e9 permettraient aux attaquants d\u2019acc\u00e9der \u00e0 [...]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/\" \/>\n<meta property=\"og:site_name\" content=\"Funio Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/FunioHosting\" \/>\n<meta property=\"article:published_time\" content=\"2014-06-02T22:52:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-06-02T22:52:30+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@funiohosting\" \/>\n<meta name=\"twitter:site\" content=\"@funiohosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/#article\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb\",\"datePublished\":\"2014-06-02T22:52:22+00:00\",\"dateModified\":\"2014-06-02T22:52:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/\"},\"wordCount\":318,\"commentCount\":0,\"keywords\":[\"Default\",\"http:\\\/\\\/media.funio.com\\\/images\\\/kb\\\/blog\\\/wordpress-logo.png\",\"s\u00e9curit\u00e9\",\"wordpress\"],\"articleSection\":[\"Funio\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/\",\"url\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/\",\"name\":\"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.funio.com\\\/fr\\\/#website\"},\"datePublished\":\"2014-06-02T22:52:22+00:00\",\"dateModified\":\"2014-06-02T22:52:30+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/06\\\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/blog.funio.com\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.funio.com\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/blog.funio.com\\\/fr\\\/\",\"name\":\"Funio Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.funio.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/author\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/","og_locale":"en_US","og_type":"article","og_title":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog","og_description":"Les passionn\u00e9s de la s\u00e9curit\u00e9 chez Sucuri ont trouv\u00e9 deux failles importantes dans la s\u00e9curit\u00e9 du tr\u00e8s populaire module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb. Effectivement, avec plus de 18 millions de t\u00e9l\u00e9chargements, nous croyons que tout utilisateur WordPress devrait \u00eatre au courant de cette situation. Ces br\u00e8ches de s\u00e9curit\u00e9 permettraient aux attaquants d\u2019acc\u00e9der \u00e0 [...]","og_url":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/","og_site_name":"Funio Blog","article_publisher":"https:\/\/www.facebook.com\/FunioHosting","article_published_time":"2014-06-02T22:52:22+00:00","article_modified_time":"2014-06-02T22:52:30+00:00","twitter_card":"summary_large_image","twitter_creator":"@funiohosting","twitter_site":"@funiohosting","twitter_misc":{"Written by":"","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/#article","isPartOf":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/"},"author":{"name":"","@id":""},"headline":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb","datePublished":"2014-06-02T22:52:22+00:00","dateModified":"2014-06-02T22:52:30+00:00","mainEntityOfPage":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/"},"wordCount":318,"commentCount":0,"keywords":["Default","http:\/\/media.funio.com\/images\/kb\/blog\/wordpress-logo.png","s\u00e9curit\u00e9","wordpress"],"articleSection":["Funio"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/","url":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/","name":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module Wordpress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb — Funio Blog","isPartOf":{"@id":"https:\/\/blog.funio.com\/fr\/#website"},"datePublished":"2014-06-02T22:52:22+00:00","dateModified":"2014-06-02T22:52:30+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/blog.funio.com\/fr\/2014\/06\/vulnerabilite-trouvee-dans-le-module-wordpress-all-in-one-seo-pack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.funio.com\/fr\/"},{"@type":"ListItem","position":2,"name":"Vuln\u00e9rabilit\u00e9 trouv\u00e9e dans le module WordPress \u00ab\u00a0All In One SEO Pack\u00a0\u00bb"}]},{"@type":"WebSite","@id":"https:\/\/blog.funio.com\/fr\/#website","url":"https:\/\/blog.funio.com\/fr\/","name":"Funio Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.funio.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"","url":"http:\/\/blog.funio.com\/fr\/author\/"}]}},"_links":{"self":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/comments?post=2654"}],"version-history":[{"count":3,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2654\/revisions"}],"predecessor-version":[{"id":2657,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2654\/revisions\/2657"}],"wp:attachment":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/media?parent=2654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/categories?post=2654"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/tags?post=2654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}