PT-2013-3592 · WordPress · Wordpress

Jan Lieskovsky · Publicado 2013-07-01 · Atualizado 2013-10-07 · CVE-2013-2202

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.5.2

Description The issue allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This means that attackers can potentially access sensitive information by manipulating the XML response.

Recommendations For WordPress versions prior to 3.5.2, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the oEmbed XML provider to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-2202

DSA-2718-1

MGASA-2013-0198

Produtos afetados

Wordpress

Referências · 13

• https://security-tracker.debian.org/tracker/CVE-2013-2202 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-2202 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=10596 · Nota
• http://wordpress.org/news/2013/06/wordpress-3-5-2 · Aviso do Fabricante
• http://codex.wordpress.org/Version_3.5.2 · Nota
• http://debian.org/security/2013/dsa-2718 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=976784 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2202 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2202 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2013-0198.html · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2202 · Nota
• https://osv.dev/vulnerability/MGASA-2013-0198 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=973254 · Nota