CVE-2013-5739

Exploit

EPSS 0.25%
Published 12.09.2013 13:30:13
Last modified 11.04.2025 00:51:21
Source cve@mitre.org
Teams watchlist Login
Open Login

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.

Affected products Warnungen 0 Metrics 2 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Wordpress ≫ Wordpress Version <= 3.6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.25%	0.485

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	3.5	6.8	2.9	AV:N/AC:M/Au:S/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://codex.wordpress.org/Version_3.6.1

Vendor Advisory

http://wordpress.org/news/2013/09/wordpress-3-6-1/

Patch

Vendor Advisory

http://www.debian.org/security/2013/dsa-2757

http://core.trac.wordpress.org/changeset/25322

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2013-5739

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-5739

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-5739

EUVD