PT-2007-4802 · Automattic · Wordpress Mu+1

Alexander Concha · Publicado 2007-07-03 · Atualizado 2013-09-08 · CVE-2007-3544

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions 2.2.1 WordPress MU version 1.2.3

Description The issue is related to an unrestricted file upload vulnerability. This allows remote authenticated users to upload and execute arbitrary PHP code. The vulnerability might be connected to the use of custom fields in normal posts and the wp postmeta table.

Recommendations For WordPress version 2.2.1, update to a version that includes a complete fix for the issue. For WordPress MU version 1.2.3, update to a version that includes a complete fix for the issue. As a temporary workaround, consider restricting file uploads to authorized users only until a patch is available.

Correção

Identificadores relacionados

CVE-2007-3544

Produtos afetados

Wordpress

Wordpress Mu

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3544 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3544 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2007-3544 · Aviso do Fabricante
• http://buayacorp.com/files/wordpress/wordpress-advisory.html · Nota
• https://osv.dev/vulnerability/CVE-2007-3544 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3544 · Nota de Segurança
• http://osvdb.org/37294 · Nota