PT-2007-4894 · WordPress · Wordpress

Nicholas Coblentz + 1 · Publicado 2007-07-10 · Atualizado 2018-10-15 · CVE-2007-3639

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.2.2

Description The issue allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information. This is related to the wp http referer parameter in wp-pass.php, the wp get referer function in wp-includes/functions.php, and possibly other vectors in wp-includes/pluggable.php and the wp nonce ays function in wp-includes/functions.php.

Recommendations For WordPress versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-pass.php file and avoiding the use of the wp http referer parameter until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3639

DSA-1564-1

Produtos afetados

Wordpress

Referências · 11

• http://debian.org/security/2008/dsa-1564 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3639 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2007-3639 · Aviso do Fabricante
• http://secunia.com/advisories/30013 · Nota
• http://securityreason.com/securityalert/2869 · Nota
• http://osvdb.org/40802 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35272 · Nota
• https://osv.dev/vulnerability/CVE-2007-3639 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3639 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3639 · Nota
• http://securityfocus.com/archive/1/472885/100/0/threaded · Nota