WordPress < 2.0.3 Arbitrary Code Injection

high Nessus Network Monitor Plugin ID 3647

Synopsis

The remote host is vulnerable to an arbitrary 'command insertion' flaw.

Description

The remote WordPress application is vulnerable to an arbitrary 'code injection' flaw. The application fails to sanitize cached 'username' data. An attacker exploiting this flaw would send a malformed request to the WordPress application. Successful exploitation would result in the attacker running arbitrary commands with the permission of the WordPress application.

Solution

Upgrade to WordPress 2.0.3, or later.

Plugin Details

Severity: High

ID: 3647

Family: CGI

Published: 6/12/2006

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Reference Information

CVE: CVE-2006-2667, CVE-2006-2702

BID: 18372

Detections

Analytics