[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Nov 2008 21:05:17 -0600
From: Raphael Geissert <atomo64+debian@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: wordpress can be subject of delayed attacks via cookies
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
Due to the completely incorrect usage of $_REQUEST almost all over the place
wordpress is subject to delayed attacks via cookies.
The attack can be performed as long as there is some way to inject a cookie
which is sent by the browser to the server.
More info at http://bugs.debian.org/504771
Could a CVE id be assigned please?
Thanks in advance.
Kind regards,
- --
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkkc6u0ACgkQYy49rUbZzlrmmQCfZNQ6ZERLCODohN1+TTvUcXvs
KHcAn1rGqXuxrvmPU70ULqeR75L3vp1X
=pVPw
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
