Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Aug 2014 01:40:31 -0400 (EDT)
From: cve-assign@...re.org
To: nacin@...dpress.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: WordPress 3.9.2 release - needs CVE's

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>  > XSS: https://core.trac.wordpress.org/changeset/29398
>>
>> We think this can have a CVE ID only if it allows privilege escalation
>> from Administrator to Super Admin in a Multisite installation. Does
>> it? (On other installations, Administrator has the unfiltered_html
>> capability.)
>>
>
> Yes.

Use CVE-2014-5240.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJT7EsgAAoJEKllVAevmvms+hoH/ilXPjm0IpKxiCloifcRPBk2
QnYSIOiCf3YkTjJ338M8+eCVFOvyZ5l0AUzTkGbVPlT9umDQPyQremAc9+zQnc30
d6OCfEmUdxodhh88Ir55YsxUtw00iZBFYZvDzTmdQJpGElqQmaff1o4R63ANTU/+
RbEEGsbrEjhhDw7lwTGuaXj2s24rMG4YgBd+Ny2aUhFCrj54gQlMlM1uhtKXdmJp
FuBwPJIu8ZmZJA1Lt9eglJ4mn+LJMaVaVLU2JXAihznyNiZuB5W95ZTF8NQjKBJa
+2olT6n/NhlQL9ud4qTxZbEI9zNu8zgANBWRQVhW/LM21tPuPUyb4/AKJmbyiRw=
=YagB
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ