Detections
Analytics

FreeBSD : wordpress -- multiple issues (8a9f86de-d080-11e9-9051-4c72b94353b5)

high Nessus Plugin ID 128587

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

wordpress developersreports :

Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments.

Props to Tim Coen for disclosing an issue where validation and sanitization of a URL could lead to an open redirect.

Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.

Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability for cross-site scripting (XSS) in shortcode previews.

Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard.

Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting (XSS) attacks.

In addition to the above changes, we are also updating jQuery on older versions of WordPress. This change was added in 5.2.1 and is now being brought to older versions.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?774f56d0

http://www.nessus.org/u?c5910cff

Plugin Details

Severity: High

ID: 128587

File Name: freebsd_pkg_8a9f86ded08011e990514c72b94353b5.nasl

Version: 1.1

Type: local

Published: 9/9/2019

Updated: 9/9/2019

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:de-wordpress, p-cpe:/a:freebsd:freebsd:fr-wordpress, p-cpe:/a:freebsd:freebsd:ja-wordpress, p-cpe:/a:freebsd:freebsd:ru-wordpress, p-cpe:/a:freebsd:freebsd:wordpress, p-cpe:/a:freebsd:freebsd:zh_cn-wordpress, p-cpe:/a:freebsd:freebsd:zh_tw-wordpress, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 9/6/2019

Vulnerability Publication Date: 9/5/2019