oss-security - CVE request: wordpress can be subject of delayed attacks via cookies

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID:  <gfiptm$jv8$1@ger.gmane.org>
Date:  Thu, 13 Nov 2008 21:05:17 -0600
From:  Raphael Geissert <atomo64+debian@...il.com>
To: oss-security@...ts.openwall.com
Subject:  CVE request: wordpress can be subject of delayed attacks via cookies

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Due to the completely incorrect usage of $_REQUEST almost all over the place 
wordpress is subject to delayed attacks via cookies.

The attack can be performed as long as there is some way to inject a cookie 
which is sent by the browser to the server.

More info at http://bugs.debian.org/504771

Could a CVE id be assigned please?

Thanks in advance.

Kind regards,
- -- 
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkc6u0ACgkQYy49rUbZzlrmmQCfZNQ6ZERLCODohN1+TTvUcXvs
KHcAn1rGqXuxrvmPU70ULqeR75L3vp1X
=pVPw
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.