[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0908181645090.17763@faron.mitre.org>
Date: Tue, 18 Aug 2009 16:45:45 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- WordPress
On Tue, 21 Jul 2009, Jan Lieskovsky wrote:
> latest WordPress 2.8.2 version has addressed a XSS vulnerability:
>
> XSS via unescaped HTML URLs as author comments in the admin page
======================================================
Name: CVE-2009-2851
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2851
Reference: MLIST:[oss-security] 20090721 CVE Request -- WordPress
Reference: URL:http://www.openwall.com/lists/oss-security/2009/07/21/1
Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=278492
Reference: CONFIRM:http://wordpress.org/development/2009/07/wordpress-2-8-2/
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=512900
Reference: FEDORA:FEDORA-2009-8109
Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01241.html
Reference: FEDORA:FEDORA-2009-8114
Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01253.html
Reference: SECTRACK:1022589
Reference: URL:http://securitytracker.com/id?1022589
Cross-site scripting (XSS) vulnerability in the administrator
interface in WordPress before 2.8.2 allows remote attackers to inject
arbitrary web script or HTML via a comment author URL.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
