PT-2007-3004 · WordPress · Wordpress

Alexander Concha + 1 · Publicado 2007-03-23 · Atualizado 2011-03-08 · CVE-2007-1622

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.0.10 RC2 WordPress versions prior to 2.1.3 RC2 in the 2.1 series

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH INFO in the administration interface. This is related to loose regular expression processing of PHP SELF.

Recommendations For WordPress versions prior to 2.0.10 RC2, update to version 2.0.10 RC2 or later. For WordPress versions prior to 2.1.3 RC2 in the 2.1 series, update to version 2.1.3 RC2 or later.

Exploit

Correção

Identificadores relacionados

CVE-2007-1622

DSA-1285-1

Produtos afetados

Wordpress

Referências · 13

• 🔥 https://exploit-db.com/exploits/29754 · Exploit
• 🔥 http://buayacorp.com/files/wordpress/wordpress-advisory.txt · Exploit
• https://osv.dev/vulnerability/CVE-2007-1622 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1622 · Nota de Segurança
• http://secunia.com/advisories/24567 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1005 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1622 · Nota
• http://securityfocus.com/bid/23027 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-1622 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1622 · Aviso do Fabricante
• http://debian.org/security/2007/dsa-1285 · Aviso do Fabricante
• http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006 · Nota
• http://secunia.com/advisories/25108 · Nota