PT-2008-5106 · WordPress · Wordpress

Hanno Böck · Published 2008-08-27 · Updated 2017-08-08 · CVE-2008-3747

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 2.6.1

Description The issue concerns the get edit post link and get edit comment link functions in WordPress, which do not enforce SSL communication as intended. This could allow remote attackers to gain administrative access by intercepting cookies over the network.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3747

Affected Products

Wordpress

References · 10

• https://security-tracker.debian.org/tracker/CVE-2008-3747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3747 · Security Note
• https://osv.dev/vulnerability/CVE-2008-3747 · Vendor Advisory
• http://trac.wordpress.org/ticket/7359 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3747 · Vendor Advisory
• http://openwall.com/lists/oss-security/2008/08/19/1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3747 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44569 · Note
• http://securityfocus.com/bid/30750 · Note
• http://openwall.com/lists/oss-security/2008/08/20/3 · Note