4.3

CVE-2007-4893

WordPress Core <= 2.2.2 - Cross-Site Scripting

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
Mögliche Gegenmaßnahme
WordPress: Update to version 2.2.3, or a newer patched version
WordPress MU: Update to version 1.2.5a, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version 0.6.2
Wordpress ≫ Wordpress Version 0.6.2.1
Wordpress ≫ Wordpress Version 0.7
Wordpress ≫ Wordpress Version 0.71
Wordpress ≫ Wordpress Version 1.2
Wordpress ≫ Wordpress Version 1.2.1
Wordpress ≫ Wordpress Version 1.2.2
Wordpress ≫ Wordpress Version 1.5
Wordpress ≫ Wordpress Version 1.5.1
Wordpress ≫ Wordpress Version 1.5.1.2
Wordpress ≫ Wordpress Version 1.5.1.3
Wordpress ≫ Wordpress Version 2.0
Wordpress ≫ Wordpress Version 2.0.1
Wordpress ≫ Wordpress Version 2.0.2
Wordpress ≫ Wordpress Version 2.0.3
Wordpress ≫ Wordpress Version 2.0.4
Wordpress ≫ Wordpress Version 2.0.5
Wordpress ≫ Wordpress Version 2.0.6
Wordpress ≫ Wordpress Version 2.0.7
Wordpress ≫ Wordpress Version 2.0.10_rc1
Wordpress ≫ Wordpress Version 2.0.10_rc2
Wordpress ≫ Wordpress Version 2.1.1
Wordpress ≫ Wordpress Version 2.1.2
Wordpress ≫ Wordpress Version 2.1.3
Wordpress ≫ Wordpress Version 2.1.3_rc1
Wordpress ≫ Wordpress Version 2.1.3_rc2
Wordpress ≫ Wordpress Version 2.2
Wordpress ≫ Wordpress Version 2.2.1
Wordpress ≫ Wordpress Version 2.2.2
Wordpress ≫ Wordpress Version 2.2_revision5002
Wordpress ≫ Wordpress Version 2.2_revision5003
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version *-2.2.2
SystemWordPress Core
≫
Produkt WordPress MU
Version [*, 1.2.5a)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.52% 0.713
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://fedoranews.org/updates/FEDORA-2007-214.shtml
http://secunia.com/advisories/26771
Vendor Advisory
http://secunia.com/advisories/26796
http://trac.wordpress.org/ticket/4720
http://wordpress.org/development/2007/09/wordpress-223/
http://www.securityfocus.com/bid/25639
http://www.vupen.com/english/advisories/2007/3132
https://bugzilla.redhat.com/show_bug.cgi?id=285831
https://exchange.xforce.ibmcloud.com/vulnerabilities/36576
https://www.wordfence.com/threat-intel/vulnerabilities/id/26daa367-ef73-4ae0-843e-6d5366cc4ecd
Third Party Advisory