Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 28 Jan 2013 10:56:48 +0200
From: Henri Salo <>
Cc: Andrew Nacin <>,
Subject: CVE request: WordPress 3.1.4 (and 3.2 Release Candidate 3)


Vulnerabilities fixed in WordPress 3.1.4[1] does not yet have CVE identifiers. As far as I can tell there is three different issues[2][3][4]. Details of issue OSVDB:73721 from Andrew Nacin below:

Using specially crafted requests under certain conditions, users without the ability to write with unfiltered HTML could add some to a post, and could update posts where they did not have a permission to do so. The relevant changeset is:

2: WordPress Unspecified Access Restriction Bypass
3: WordPress wp-admin/edit-tags.php Multiple Parameter SQL Injection
4: WordPress wp-admin/link-manager.php Multiple Parameter SQL Injection

Please note that these need to be CVE-2011-XXXX, thanks.

Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.