CVE-2007-1049
published 2007-02-21CVE-2007-1049: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
6.29%
92.7th percentile
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.1.2-1 (bookworm) | wordpress 2.1.2-1 (bookworm) |
| debian | wordpress | < wordpress 2.1.1-1 (bookworm) | wordpress 2.1.1-1 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | >= 0 < 2.1.1-1 | 2.1.1-1 |
| wordpress | wordpress | >= 0 < 2.1.2-1 | 2.1.2-1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5c83-v5f6-vqjc: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions
ghsa_unreviewed·2022-05-01
CVE-2007-1049 [MEDIUM] GHSA-5c83-v5f6-vqjc: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
GHSA
GHSA-pqc9-8ghg-8vc2: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions
ghsa_unreviewed·2022-05-01·CVSS 4.3
CVE-2007-1230 [MEDIUM] GHSA-pqc9-8ghg-8vc2: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.
OSV
CVE-2007-1230: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions
osv·2007-03-02·CVSS 4.3
CVE-2007-1230 [MEDIUM] CVE-2007-1230: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.
OSV
CVE-2007-1049: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions
osv·2007-02-21·CVSS 4.3
CVE-2007-1049 [MEDIUM] CVE-2007-1049: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Debian
CVE-2007-1230: wordpress - Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php...
vendor_debian·2007·CVSS 4.3
CVE-2007-1230 [MEDIUM] CVE-2007-1230: wordpress - Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php...
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.
Scope: local
bookworm: resolved (fixed in 2.1.2-1)
bullseye: resolved (fixed in 2.1.2-1)
forky: resolved (fixed in 2.1.2-1)
sid: resolved (fixed in 2.1.2-1)
trixie: resolved (fixed in 2.1.2-1)
Debian
CVE-2007-1049: wordpress - Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the...
vendor_debian·2007·CVSS 4.3
CVE-2007-1049 [MEDIUM] CVE-2007-1049: wordpress - Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the...
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Scope: local
bookworm: resolved (fixed in 2.1.1-1)
bullseye: resolved (fixed in 2.1.1-1)
forky: resolved (fixed in 2.1.1-1)
sid: resolved (fixed in 2.1.1-1)
trixie: resolved (fixed in 2.1.1-1)
No detection rules found.
Bugzilla
CVE-2006-4538 kernel: Local DoS with corrupted ELF
bugzilla·2007-09-13·CVSS 4.9
CVE-2006-4538 [MEDIUM] CVE-2006-4538 kernel: Local DoS with corrupted ELF
CVE-2006-4538 kernel: Local DoS with corrupted ELF
Already fixed for RHEL4, but not for RHEL3/2.1-ia64. See bz#205335 for
EL4 reproducer.
From Kirill Korotaev:
When running on IA64 or SPARC platforms, local users can cause a denial of
service via a malformed ELF file and then triggered by cross-region mappings.
http://lkml.org/lkml/2006/9/4/116
Discussion:
This issue has been addressed in following products:
Red Hat Linux Enterprise 2.1
Red Hat Linux Enterprise 3
Via RHSA-2007:1049 available at https://rhn.redhat.com/errata/RHSA-2007-1049.html and RHSA-2008:0787 available at https://rhn.redhat.com/errata/RHSA-2008-0787.html
Bugzilla
CVE-2007-1049: wordpress < 2.1.1 XSS
bugzilla·2007-02-25·CVSS 4.3
CVE-2007-1049 [MEDIUM] CVE-2007-1049: wordpress < 2.1.1 XSS
CVE-2007-1049: wordpress < 2.1.1 XSS
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1049
"Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in
the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before
2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web
script or HTML via the file parameter to wp-admin/templates.php, and possibly
other vectors involving the action variable."
FE5+ apparently affected.
Discussion:
New packages uploaded / built
---
Although John Beringer indicates as of 2007-02-27, new packages have
been uploaded and built for Wordpress, I am not seeing any new packages
in Extras repositories for Wordpress for FC5 nor for devel. What's going on?
---
Indeed, it seems that the new versions were tagged,
http://downloads.securityfocus.com/vulnerabilities/exploits/22534.htmlhttp://osvdb.org/33766http://secunia.com/advisories/24306http://secunia.com/advisories/24566http://trac.wordpress.org/changeset/4876http://trac.wordpress.org/changeset/4877http://trac.wordpress.org/ticket/3781http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlhttp://www.securityfocus.com/bid/22534http://www.vupen.com/english/advisories/2007/0741http://downloads.securityfocus.com/vulnerabilities/exploits/22534.htmlhttp://osvdb.org/33766http://secunia.com/advisories/24306http://secunia.com/advisories/24566http://trac.wordpress.org/changeset/4876http://trac.wordpress.org/changeset/4877http://trac.wordpress.org/ticket/3781http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlhttp://www.securityfocus.com/bid/22534http://www.vupen.com/english/advisories/2007/0741
2007-02-21
Published