PT-2007-3004 · WordPress · Wordpress

Alexander Concha + 1 · Published 2007-03-23 · Updated 2011-03-08 · CVE-2007-1622

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.0.10 RC2 WordPress versions prior to 2.1.3 RC2 in the 2.1 series

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH INFO in the administration interface. This is related to loose regular expression processing of PHP SELF.

Recommendations For WordPress versions prior to 2.0.10 RC2, update to version 2.0.10 RC2 or later. For WordPress versions prior to 2.1.3 RC2 in the 2.1 series, update to version 2.1.3 RC2 or later.

Exploit

Fix

Related Identifiers

CVE-2007-1622

DSA-1285-1

Affected Products

Wordpress

References · 13

• 🔥 https://exploit-db.com/exploits/29754 · Exploit
• 🔥 http://buayacorp.com/files/wordpress/wordpress-advisory.txt · Exploit
• https://osv.dev/vulnerability/CVE-2007-1622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1622 · Security Note
• http://secunia.com/advisories/24567 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1622 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1622 · Vendor Advisory
• http://debian.org/security/2007/dsa-1285 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1005 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1622 · Note
• http://securityfocus.com/bid/23027 · Note
• http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006 · Note
• http://secunia.com/advisories/25108 · Note