Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 05 Jan 2012 10:02:34 -0700
From: Kurt Seifried <kseifrie@...hat.com>
To: oss-security@...ts.openwall.com
CC: Henri Salo <henri@...v.fi>
Subject: Re: CVE-request: WordPress plugin Adminimize XSS

On 01/05/2012 04:06 AM, Henri Salo wrote:
> Original advisory: http://www.securityfocus.com/archive/1/520591
> OSVDB: http://osvdb.org/show/osvdb/77472
> Fixed in: 1.7.22
> Vulnerable: All before 1.7.22
> SCM: http://plugins.svn.wordpress.org/adminimize/
> Changelog: http://wordpress.org/extend/plugins/adminimize/changelog/
>
> Should be 2011 CVE.
>
> fgeek@...mple:~/adminimize/tags$ diff 1.7.21/adminimize_page.php 1.7.22/adminimize_page.php 
> 121c121
> <       <form name="backend_option" method="post" id="_mw_adminimize_options" action="?page=<?php echo $_GET['page'];?>" >
> ---
>>       <form name="backend_option" method="post" id="_mw_adminimize_options" action="?page=<?php echo esc_attr( $_GET['page'] );?>" >
> - Henri Salo
This is an example of a *GREAT* CVE request, he even tells me what year
it should be. Very handy for the next month or so.

Please use CVE-2011-4926 for this issue.

-- 

-- Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.