Detections
Analytics

WordPress < 3.5.2 Multiple Vulnerabilities

low Nessus Network Monitor Plugin ID 6883

Synopsis

The remote server is hosting an outdated installation of WordPress that is vulnerable to multiple attack vectors.

Description

Versions of WordPress earlier than 3.5.2 are potentially affected by the following vulnerabilities :

 - The application contains a denial of service attack affecting sites using password-protected posts.(CVE-2013-2173)
 - The application is affected by a server-side request forgery vulnerability. This vulnerability can be used to gain access to a site. (CVE-2013-2199)
 - A privilege escalation vulnerability exists that allows contributors to publish posts and users to reassign authorship. (CVE-2013-2200)
 - A cross-site scripting vulnerability exists related to uploading media. (CVE-2013-2201)
 - A XML External Entity Injection (XXE) vulnerability exists in 'oEmbed'. (CVE-2013-2202)
 - A vulnerability exists disclosing a full file path related to file upload. (CVE-2013-2203)
 - A cross-site scripting vulnerability exists related to 'TinyMCE' library. (CVE-2013-2204)
 - The application is affected by a cross-site scripting vulnerability in the 'SWFUpload' library. (CVE-2013-2205)
 - Cross-site scripting vulnerabilities exist in the 'post.php' script relating to the 'excerpt' and 'content' parameters.

Solution

Upgrade to WordPress 3.5.2, or later.

See Also

http://wordpress.org/news/2013/06/wordpress-3-5-2

http://codex.wordpress.org/Version_3.5.2

http://seclists.org/fulldisclosure/2013/Jul/7

Plugin Details

Severity: Low

ID: 6883

Family: CGI

Published: 5/25/2013

Updated: 3/6/2019

Nessus ID: 67021

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Patch Publication Date: 6/21/2013

Vulnerability Publication Date: 6/21/2013

Reference Information

CVE: CVE-2013-2173, CVE-2013-2199, CVE-2013-2200, CVE-2013-2201, CVE-2013-2202, CVE-2013-2203, CVE-2013-2204, CVE-2013-2205

BID: 60477, 60757, 60758, 60759, 60770, 60775, 60781, 60825, 60892