Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0908181645090.17763@faron.mitre.org>
Date: Tue, 18 Aug 2009 16:45:45 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- WordPress



On Tue, 21 Jul 2009, Jan Lieskovsky wrote:

>   latest WordPress 2.8.2 version has addressed a XSS vulnerability:
>
>     XSS via unescaped HTML URLs as author comments in the admin page


======================================================
Name: CVE-2009-2851
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2851
Reference: MLIST:[oss-security] 20090721 CVE Request -- WordPress
Reference: URL:http://www.openwall.com/lists/oss-security/2009/07/21/1
Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=278492
Reference: CONFIRM:http://wordpress.org/development/2009/07/wordpress-2-8-2/
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=512900
Reference: FEDORA:FEDORA-2009-8109
Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01241.html
Reference: FEDORA:FEDORA-2009-8114
Reference: URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01253.html
Reference: SECTRACK:1022589
Reference: URL:http://securitytracker.com/id?1022589

Cross-site scripting (XSS) vulnerability in the administrator
interface in WordPress before 2.8.2 allows remote attackers to inject
arbitrary web script or HTML via a comment author URL.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.