CERTA-2010-AVI-638

Vulnerability from certfr_avis - Published: 2010-12-31 - Updated: 2010-12-31

De multiples vulnérabilités dans WordPress permettent de réaliser des injections de code indirectes.

Description

De multiples vulnérabilités ont été découvertes dans la bibliothèque KSES de WordPress. L'exploitation de ces failles permet des injections de code indirectes.

Solution

Mettre WordPress à jour en version 3.0.4.

WordPress versions 3.0.3 et antérieures.

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard Create KEV Entry 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cSPAN class=\"textit\"\u003eWordPress\u003c/SPAN\u003e versions 3.0.3 et  ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans la biblioth\u00e8que\nKSES de WordPress. L\u0027exploitation de ces failles permet des injections\nde code indirectes.\n\n## Solution\n\nMettre WordPress \u00e0 jour en version 3.0.4.\n",
  "cves": [],
  "initial_release_date": "2010-12-31T00:00:00",
  "last_revision_date": "2010-12-31T00:00:00",
  "links": [],
  "reference": "CERTA-2010-AVI-638",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-12-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans \u003cspan class=\"textit\"\u003eWordPress\u003c/span\u003e\npermettent de r\u00e9aliser des injections de code indirectes.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans WordPress",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Notes de la version 3.0.4 de WordPress du 29 d\u00e9cembre 2010",
      "url": "http://codex.wordpress.org/Version_3.0.4"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.