high7.5
CVE-2013-4339
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restriction…
Impact
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | through 3.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://codex.wordpress.org/Version_3.6.1
- http://core.trac.wordpress.org/changeset/25323
- http://core.trac.wordpress.org/changeset/25324
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html
- http://seclists.org/fulldisclosure/2013/Dec/174
- http://wordpress.org/news/2013/09/wordpress-3-6-1/
- http://www.debian.org/security/2013/dsa-2757
- http://www.osvdb.org/101181
- http://codex.wordpress.org/Version_3.6.1
- http://core.trac.wordpress.org/changeset/25323
- http://core.trac.wordpress.org/changeset/25324
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html
- http://seclists.org/fulldisclosure/2013/Dec/174
- http://wordpress.org/news/2013/09/wordpress-3-6-1/
- http://www.debian.org/security/2013/dsa-2757
- http://www.osvdb.org/101181