Detections
Analytics

Fedora 36 : wordpress (2022-4e099582c7)

high Nessus Plugin ID 169256

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-4e099582c7 advisory.

 **WordPress 6.0.3 Security Release**

 Security updates included in this release

 * Stored XSS via wp-mail.php (post by email) Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT
 * Open redirect in `wp_nonce_ays` devrayn
 * Senders email address is exposed in wp-mail.php Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT
 * Media Library Reflected XSS via SQLi Ben Bidner from the WordPress security team and Marc Montpas from Automattic independently discovered this issue
 * CSRF in wp-trackback.php Simon Scannell
 * Stored XSS via the Customizer Alex Concha from the WordPress security team
 * Revert shared user instances introduced in 50790 Alex Concha and Ben Bidner from the WordPress security team
 * Stored XSS in WordPress Core via Comment Editing Third-party security audit and Alex Concha from the WordPress security team
 * Data exposure via the REST Terms/Tags Endpoint Than Taintor
 * Content from multipart emails leaked Thomas Krftner
 * SQL Injection due to improper sanitization in `WP_Date_Query` Michael Mazzolini
 * RSS Widget: Stored XSS issue Third-party security audit
 * Stored XSS in the search block Alex Concha of the WP Security team
 * Feature Image Block: XSS issue Third-party security audit
 * RSS Block: Stored XSS issue Third-party security audit
 * Fix widget block XSS Third-party security audit


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected wordpress package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2022-4e099582c7

Plugin Details

Severity: High

ID: 169256

File Name: fedora_2022-4e099582c7.nasl

Version: 1.1

Type: local

Agent: unix

Published: 12/23/2022

Updated: 11/14/2024

Supported Sensors: Agentless Assessment, continuous_assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:wordpress, cpe:/o:fedoraproject:fedora:36

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/18/2022

Vulnerability Publication Date: 10/18/2022

Reference Information