WordPress < 2.8.6 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 5233

Synopsis

The remote server is hosting an outdated installation of WordPress that is vulnerable to multiple attack vectors.

Description

The remote host is running a version of WordPress earlier than 2.8.6. Such versions are potentially affected by multiple vulnerabilities :

- A file-upload and code execution vulnerability in the 'wp-admin/includes/file.php' script.

- A cross-site scripting vulnerability in 'Press This'.

Solution

Upgrade to WordPress 2.8.6, or later.

See Also

http://www.securityfocus.com/archive/1/507819/30/0/threaded

http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release

Plugin Details

Severity: High

ID: 5233

Family: CGI

Published: 2009/11/13

Modified: 2018/09/16

Dependencies: 9035

Nessus ID: 42801

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Patch Publication Date: 2009/11/12

Vulnerability Publication Date: 2009/11/12

Reference Information

CVE: CVE-2009-3890, CVE-2009-3891

BID: 37005, 37014