The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.

Versions of WordPress prior to 3.6.1 are susceptible to the following vulnerabilities :

 - A flaw exists in the 'get_allowed_mime_types function' in 'wp-includes/functions.php'.  The issue is due to the program failing to properly restrict file uploads for SWF and EXE files.  With a specially crafted file, a remote authenticated attacker can more easily conduct a cross-site scripting (XSS) attack. (CVE-2013-5739)
 - A flaw exists in the 'wp-includes/functions.php' script that is due to the program failing to determine whether data has been serialized.  With a saturation of PHP unserialize operations, a remote attacker can potentially execute arbitrary code. (CVE-2013-4338)
 - A flaw exists that is triggered when handling a specially crafted string, which can result in URLs not being properly validated before an HTTP redirect.  This may allow a remote attacker to bypass redirect restrictions. (CVE-2013-4339)
 - A flaw exists in the 'wp-admin/includes/post.php' script that is triggered when handling a specially crafted 'user_ID' parameter.  This may allow a remote attacker to spoof the authorship of arbitrary posts. (CVE-2013-4340)
 - A flaw exists in the 'get_allowed_mime_types' function in 'wp-includes/functions.php' that is due to HTML file uploads not requiring the unfiltered_html capability.  With a specially crafted file, a remote attacker can more easily conduct a cross-site scripting (XSS) attack. (CVE-2013-5738)
 - A flaw exists that allows a remote cross site redirection attack.  This flaw exists because the application does not validate input passed via '_wp_http_referer' or '_wp_original_http_referer' upon submission to the 'edit-tags.php' and 'media.php' scripts.  This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing.  Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site.  This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.
 - A flaw exists that allows a reflected cross-site scripting (XSS) attack.  This flaw exists because the application does not validate the '_wp_http_referer' parameter upon submission to the '/wp-admin/edit-tags.php' script.  This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

The wordpress development team reports :

- Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution.

- Prevent a user with an Author role, using a specially crafted request, from being able to create a post 'written by' another user.

- Fix insufficient input validation that could result in redirecting or leading a user to another website.

Additionally, we've adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.

Updated wordpress and php-phpmailer packages fix security vulnerabilities :

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations (CVE-2013-4338).

WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string (CVE-2013-4339).

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter (CVE-2013-4340).

The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file (CVE-2013-5738).

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php (CVE-2013-5739).

Additionally, php-phpmailer has been updated to a newer version required by the updated wordpress.

According to its version number, the WordPress install hosted on the remote web server is affected by multiple vulnerabilities :

  - Unsafe PHP de-serialization could occur in limited     situations and setups, which could lead to remote code     execution. (CVE-2013-4338)

  - Open redirect/insufficient input validation could allow     attackers to redirect users to a malicious website.
    (CVE-2013-4339)

  - A user with an Author role, using a specially crafted     request, can forge a post that appears to be posted by     another user. (CVE-2013-4340)

  - As a proactive measure to prevent cross-site scripting     attacks, extensions .swf, .exe, .htm, and .html are     filtered from file uploading. (CVE-2013-5738,     CVE-2013-5739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of backporting the patches.

This means extra care should be taken when upgrading, especially when using third-party plugins or themes, since compatibility may have been impacted along the way. We recommend that users check their install before doing the upgrade.

  - CVE-2013-4338     Unsafe PHP unserialization in wp-includes/functions.php     could cause arbitrary code execution.

  - CVE-2013-4339     Insufficient input validation could result in     redirecting or leading a user to another website.

  - CVE-2013-4340     Privilege escalation allowing an user with an author     role to create an entry appearing as written by another     user.

  - CVE-2013-5738     Insufficient capabilities were required for uploading     .html/.html files, making it easier for authenticated     users to conduct cross-site scripting attacks (XSS)     using crafted html file uploads.

  - CVE-2013-5739     Default Wordpress configuration allowed file upload for     .swf/.exe files, making it easier for authenticated     users to conduct cross-site scripting attacks (XSS).

ID	Name	Product	Family	Severity
9094	WordPress < 3.6.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
70515	FreeBSD : wordpress -- multiple vulnerabilities (043d3a78-f245-4938-9bc7-3d0d35dd94bf)	Nessus	FreeBSD Local Security Checks	high
70005	Mandriva Linux Security Advisory : wordpress (MDVSA-2013:239)	Nessus	Mandriva Local Security Checks	high
69997	WordPress < 3.6.1 Multiple Vulnerabilities	Nessus	CGI abuses	high
69895	Debian DSA-2757-1 : wordpress - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-5738

medium

Tenable Plugins

critical

high

high

high

high