Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE-request: WordPress 3.1.1
From: Yves-Alexis Perez <corsac () debian org>
Date: Thu, 19 Jan 2012 09:34:41 +0100

On mer., 2012-01-18 at 15:22 -0700, Kurt Seifried wrote:
On 01/15/2012 07:39 AM, Henri Salo wrote:
On Sun, Jan 15, 2012 at 03:32:48PM +0100, Hanno Böck wrote:
1) Certain unspecified input is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site. http://osvdb.org/show/osvdb/72141
I think this is CVE-2012-0287:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0287
I think you are correct. I do not know why I did not see this in allitems.txt.gz. Can't find other CVEs with that 
URL. There seems to be three issues. I am refering to http://wordpress.org/news/2011/04/wordpress-3-1-1/:

"Version 3.1.1 also addresses three security issues discovered by WordPress core developers Jon Cave and Peter 
Westwood, of our security team. The first hardens CSRF prevention in the media uploader. The second avoids a PHP 
crash in certain environments when handling devilishly devised links in comments, and the third addresses an XSS 
flaw."

======================================================
Name: CVE-2012-0287
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0287
Phase: Assigned (20120103)
Category: 
Reference: MISC:http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html
Reference: CONFIRM:https://wordpress.org/news/2012/01/wordpress-3-3-1/

Cross-site scripting (XSS) vulnerability in wp-comments-post.php in
WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows
remote attackers to inject arbitrary web script or HTML via the query
string in a POST operation that is not properly handled by the
"Duplicate comment detected" feature.


Current Votes:
None (candidate not yet proposed)
======================================================

- Henri Salo
I don't feel assigning a CVE for these issues would be prudent until
some details are released, I think the 3.1.1 and 3.1.3 stuff is separate
but I can't be sure. Can someone from WordPress comment?


I was asked to try security () wordpress org so I'm adding them to CC: just
in case. (to security () wordpress org, the thread beginning is at
http://openwall.com/lists/oss-security/2012/01/15/3)

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault