Detections
Analytics

Fedora 30 : wordpress (2019-709c48a989)

high Nessus Plugin ID 130303

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

**WordPress 5.2.4 Security Release**

WordPress versions 5.2.3 and earlier are affected by these bugs, which are fixed in version 5.2.4.

**Security Updates**

 - Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.

 - Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.

 - Props to Weston Ruter for finding a way to create a stored XSS to inject JavaScript into style tags.

 - Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary:
 Origin header.

 - Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.

 - Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected wordpress package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2019-709c48a989

Plugin Details

Severity: High

ID: 130303

File Name: fedora_2019-709c48a989.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/28/2019

Updated: 10/28/2019

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:wordpress, cpe:/o:fedoraproject:fedora:30

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 10/25/2019

Vulnerability Publication Date: 10/25/2019

Reference Information