WordPress.org
Get WordPress

Make WordPress Core

Opened 19 years ago

Closed 19 years ago

#4691 closed defect (bug) (fixed)

Wordpress link-import.php Cross-Site Scripting (XSS) Vulnerability

Reported by: BenjaminFlesch Owned by: Nazgul
Priority: normal Milestone: 2.0.11
Component: Security Version: 2.2.1
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

The parameter opml_url isn’t sanitized and thereby creates an Cross-Site Scripting vulnerability.

Anyways, for a successful attack the _wpnonce Authentication Token is needed so this one is quite useless - No one would use XSS to get a Token in order to use another XSS Vulnerability on the same Domain.

Attachments (2)

4691.diff​ (444 bytes ) - added by Nazgul 19 years ago.
for_22.patch​ (488 bytes ) - added by g30rg3x 19 years ago.
For Branch 2.2

Download all attachments as: .zip

Change History (11)

#1 @Nazgul
19 years ago

  • Milestone → 2.3 (trunk)

I'm unable to reproduce this one.

Could you give some more info?

#2 @BenjaminFlesch
19 years ago

ah sorry, its the cat_id . Cat_id -> XSS, but you need _wpnonces.

@Nazgul
19 years ago

#3 @Nazgul
19 years ago

  • Keywords has-patch added
  • Owner changed from anonymous to Nazgul
  • Status new → assigned

#4 @matt
19 years ago

  • Resolution → fixed
  • Status assigned → closed

(In [5835]) Sanitize cat_id, fixes #4691

@g30rg3x
19 years ago

For Branch 2.2

#5 @g30rg3x
19 years ago

also apply this for branch 2.2, thanks in advance...

#6 @markjaquith
19 years ago

  • Milestone 2.3 (trunk) → 2.2.2
  • Resolution fixed
  • Status closed → reopened

#7 @markjaquith
19 years ago

(In [5840]) Sanitize cat_id, fixes #4691 for 2.2.x, thanks g30rg3x

#8 @markjaquith
19 years ago

  • Milestone 2.2.2 → 2.0.11

#9 @markjaquith
19 years ago

  • Resolution → fixed
  • Status reopened → closed

(In [5841]) Sanitize cat_id, fixes #4691 for 2.0.x

Note: See TracTickets for help on using tickets.