[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 05 Jan 2012 10:02:34 -0700
From: Kurt Seifried <kseifrie@...hat.com>
To: oss-security@...ts.openwall.com
CC: Henri Salo <henri@...v.fi>
Subject: Re: CVE-request: WordPress plugin Adminimize XSS
On 01/05/2012 04:06 AM, Henri Salo wrote:
> Original advisory: http://www.securityfocus.com/archive/1/520591
> OSVDB: http://osvdb.org/show/osvdb/77472
> Fixed in: 1.7.22
> Vulnerable: All before 1.7.22
> SCM: http://plugins.svn.wordpress.org/adminimize/
> Changelog: http://wordpress.org/extend/plugins/adminimize/changelog/
>
> Should be 2011 CVE.
>
> fgeek@...mple:~/adminimize/tags$ diff 1.7.21/adminimize_page.php 1.7.22/adminimize_page.php
> 121c121
> < <form name="backend_option" method="post" id="_mw_adminimize_options" action="?page=<?php echo $_GET['page'];?>" >
> ---
>> <form name="backend_option" method="post" id="_mw_adminimize_options" action="?page=<?php echo esc_attr( $_GET['page'] );?>" >
> - Henri Salo
This is an example of a *GREAT* CVE request, he even tells me what year
it should be. Very handy for the next month or so.
Please use CVE-2011-4926 for this issue.
--
-- Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
