Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 25 Sep 2012 10:56:28 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Jan Lieskovsky <jlieskov@...hat.com>,
        "Steven M. Christey" <coley@...us.mitre.org>,
        WordPress Security Team <security@...dpress.org>,
        Matej Cepl <mcepl@...hat.com>
Subject: Re: CVE Request -- WordPress (3,4.2): CSRF in the
 incoming links section of the dashboard

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/25/2012 06:46 AM, Jan Lieskovsky wrote:
> Hello Kurt, Steve, WordPress Security Team, vendors,
> 
> an anonymous researcher called 'Akastep' has reported and CSRF flaw
> being present in the way WordPress of version v3.4.2 and earlier
> used to process incoming links section / widget of the dashboard.
> 
> References:
> 
> [1]
> http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html
>
> 
[2] https://bugzilla.redhat.com/show_bug.cgi?id=860261
> [3] https://bugs.gentoo.org/show_bug.cgi?id=436198 [4]
> https://secunia.com/advisories/50715/
> 
> AFAIK there is not an upstream ticket and patch for this issue yet
> (but might have overlooked something pretty obvious - WordPress 
> upstream please clarify).
> 
> Could you allocate a CVE id for this?
> 
> Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat
> Security Response Team
> 

Please use CVE-2012-4448 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQYeI8AAoJEBYNRVNeJnmT4TwQAIdWlJGkDQ3vCndzw54mk/2l
ofmXj9S0IUCMxFirJmCC7J8uS9tF96TL3N/TVE4KXaBetdk/S3/iFLhrXrtZFbQ1
ur0TLoVDxtczYJbUyRmxd9X3Sw1Is+jtBYUFEuWsxCkaPlxZQrot+ZFkbSFO8xo0
CiidqPOdgKwg+buDXTcXiyuCyLkLBEmCA+JxUdcmbDUDx+z5lQKwaYJ3i/VGclND
duyBgAN4Y9Ht6tYOpnjkHzN+YYRai8uEz+49MLBQkEDoYHZI1bVXi3lD8O8mCSC3
br4oJfHcP60gqYvbS0mzvmnr+q0DJDhuCSu/vUbFv1xN2UpcnHGFsr9RR4BAPNnQ
XN81MahJfF9H2810qpKiI0eISd4L03OFZxs9GX6NWd5zVdG0EG1efhWZbclfMNCC
kJStBligCY4qccaO4et9MK3d2NW2BEznHwHDTiNnKbgS4CeZLOiA7ly81rPQZdEj
u/Wit7jZC4ATp9plIeQ7i3pnp3JudgPvr3SZoGO7UYMvMrt2hVG8jqKS0HkNCKLN
5QMXg0rS3VWu+yeOLH2clMYsbyoDukZQClX+T+6TvLvc2ie2ehzv5bBmwDlpCEb7
+JL28uUmtXcUTCdD2IuCTmvxhQSEPHFBINQCpsr8qYdNOvh99Y5brKEWzID2fT+i
2KFQniM/uueV2pYtN/C+
=xA69
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ