oss-security - CVE request: WordPress 3.1.4 (and 3.2 Release Candidate 3)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130128085648.GB18001@kludge.henri.nerv.fi>
Date: Mon, 28 Jan 2013 10:56:48 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: Andrew Nacin <nacin@...dpress.org>, security@...dpress.org
Subject: CVE request: WordPress 3.1.4 (and 3.2 Release Candidate 3)

Hello,

Vulnerabilities fixed in WordPress 3.1.4[1] does not yet have CVE identifiers. As far as I can tell there is three different issues[2][3][4]. Details of issue OSVDB:73721 from Andrew Nacin below:

Using specially crafted requests under certain conditions, users without the ability to write with unfiltered HTML could add some to a post, and could update posts where they did not have a permission to do so. The relevant changeset is: http://core.trac.wordpress.org/changeset/18368/branches/3.1

1: http://wordpress.org/news/2011/06/wordpress-3-1-4/
2: http://osvdb.org/73721 WordPress Unspecified Access Restriction Bypass
3: http://osvdb.org/73722 WordPress wp-admin/edit-tags.php Multiple Parameter SQL Injection
4: http://osvdb.org/73723 WordPress wp-admin/link-manager.php Multiple Parameter SQL Injection

Please note that these need to be CVE-2011-XXXX, thanks.

--
Henri Salo

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.