PT-2007-4894 · WordPress · Wordpress

Nicholas Coblentz + 1 · Published 2007-07-10 · Updated 2018-10-15 · CVE-2007-3639

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.2.2

Description The issue allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information. This is related to the wp http referer parameter in wp-pass.php, the wp get referer function in wp-includes/functions.php, and possibly other vectors in wp-includes/pluggable.php and the wp nonce ays function in wp-includes/functions.php.

Recommendations For WordPress versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-pass.php file and avoiding the use of the wp http referer parameter until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3639

DSA-1564-1

Affected Products

Wordpress

References · 11

• http://debian.org/security/2008/dsa-1564 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3639 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3639 · Security Note
• http://secunia.com/advisories/30013 · Note
• http://securityreason.com/securityalert/2869 · Note
• http://osvdb.org/40802 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35272 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3639 · Note
• http://securityfocus.com/archive/1/472885/100/0/threaded · Note