PT-2010-5379 · WordPress · Wordpress

Jan Lieskovsky · Published 2010-12-07 · Updated 2017-11-21 · CVE-2010-4257

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.0.2

Description A SQL injection issue exists in the do trackbacks function, allowing remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

Recommendations For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-4257

DSA-2138-1

Affected Products

Wordpress

References · 25

• http://core.trac.wordpress.org/changeset/16625 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052892.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4257 · Vendor Advisory
• http://debian.org/security/2010/dsa-2138 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052917.html · Vendor Advisory
• http://wordpress.org/news/2010/11/wordpress-3-0-2 · Vendor Advisory
• http://codex.wordpress.org/Version_3.0.2 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052932.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4257 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052879.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-4257 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4257 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257 · Note
• http://secunia.com/advisories/42431 · Note
• http://secunia.com/advisories/42844 · Note