WordPress < 3.5.2 Multiple Vulnerabilities

medium Nessus Plugin ID 67021

Synopsis

The remote web server contains a PHP application that is affected by multiple vulnerabilities.

Description

According to its version number, the WordPress install hosted on the remote web server is affected by multiple vulnerabilities :

- The application contains a denial of service attack, affecting sites using password-protected posts.
(CVE-2013-2173)

- The application is affected by a server-side request forgery vulnerability. This vulnerability can be used to gain access to a site. (CVE-2013-2199)

- A privilege escalation vulnerability exists that allows contributors to publish posts and users to reassign authorship. (CVE-2013-2200)

- A cross-site scripting vulnerability exists related to uploading media. (CVE-2013-2201)

- A XML External Entity Injection (XXE) vulnerability exists in 'oEmbed'. (CVE-2013-2202)

- A vulnerability exists disclosing a full file path related to file upload. (CVE-2013-2203)

- A cross-site scripting vulnerability exists related to 'TinyMCE' library. (CVE-2013-2204)

- The application is affected by a cross-site scripting vulnerability in the 'SWFUpload' library.
(CVE-2013-2205)

- Cross-site scripting vulnerabilities exist in the 'post.php' script relating to the 'excerpt' and 'content' parameters.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WordPress 3.5.2 or later.

See Also

https://wordpress.org/news/2013/06/wordpress-3-5-2/

https://codex.wordpress.org/Version_3.5.2

http://www.nessus.org/u?af0aeb24

https://seclists.org/fulldisclosure/2013/Jul/7

Plugin Details

Severity: Medium

ID: 67021

File Name: wordpress_3_5_2.nasl

Version: 1.15

Type: remote

Family: CGI abuses

Published: 6/28/2013

Updated: 6/5/2024

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Required KB Items: installed_sw/WordPress, www/PHP, Settings/ParanoidReport

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Patch Publication Date: 6/21/2013

Vulnerability Publication Date: 6/21/2013

Reference Information

CVE: CVE-2013-2173, CVE-2013-2199, CVE-2013-2200, CVE-2013-2201, CVE-2013-2202, CVE-2013-2203, CVE-2013-2204, CVE-2013-2205

BID: 60477, 60757, 60758, 60759, 60770, 60775, 60781, 60825, 60892

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990