This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200701-10
(WordPress: Multiple vulnerabilities)
When decoding trackbacks with alternate character sets, WordPress does
not correctly sanitize the entries before further modifying a SQL
query. WordPress also displays different error messages in wp-login.php
based upon whether or not a user exists. David Kierznowski has
discovered that WordPress fails to properly sanitize recent file
information in /wp-admin/templates.php before sending that information
to a browser.
An attacker could inject arbitrary SQL into WordPress database queries.
An attacker could also determine if a WordPress user existed by trying
to login as that user, better facilitating brute-force attacks. Lastly,
an attacker authenticated to view the administrative section of a
WordPress instance could try to edit a file with a malicious filename
browsers viewing /wp-admin/templates.php.
There is no known workaround at this time.
See also :
All WordPress users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=www-apps/wordpress-2.0.6'
Risk factor :
Medium / CVSS Base Score : 6.8
CVSS Temporal Score : 6.5
Public Exploit Available : true
Family: Gentoo Local Security Checks
Nessus Plugin ID: 24208 (gentoo_GLSA-200701-10.nasl)
CVE ID: CVE-2006-6808CVE-2007-0107CVE-2007-0109
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.