Detections
Analytics

WordPress < 1.5.1.2 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 2918

Synopsis

The remote server is hosting an outdated installation of WordPress that is vulnerable to multiple attack vectors.

Description

Versions of WordPress prior to 1.5.1.2 are vulnerable to various flaws that may allow an attacker to perform a SQL injection attack against the remote host. Successful exploitation would allow an attacker to read/write confidential data as well as potentially execute arbitrary code on the remote database. In addition, the remote host is vulnerable to multiple cross-site scripting (XSS) flaws.

Solution

Upgrade to WordPress 1.5.1.2, or later.

See Also

http://wordpress.org/development/2005/05/security-update

Plugin Details

Severity: High

ID: 2918

Family: CGI

Published: 5/17/2005

Updated: 3/6/2019

Nessus ID: 18301

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Reference Information

CVE: CVE-2005-1810

BID: 13655, 13809, 13663, 13664