CVE-2008-3747
published 2008-08-27CVE-2008-3747: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in…
PriorityP337high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.55%
83.3th percentile
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.5.1-6 (bookworm) | wordpress 2.5.1-6 (bookworm) |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2008-3747: wordpress - The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-include...
vendor_debian·2008·CVSS 7.5
CVE-2008-3747 [HIGH] CVE-2008-3747: wordpress - The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-include...
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
Scope: local
bookworm: resolved (fixed in 2.5.1-6)
bullseye: resolved (fixed in 2.5.1-6)
forky: resolved (fixed in 2.5.1-6)
sid: resolved (fixed in 2.5.1-6)
trixie: resolved (fixed in 2.5.1-6)
Red Hat
wordpress: insufficient SSL communication enforcement
vendor_redhat·CVSS 7.5
CVE-2008-3747 [HIGH] wordpress: insufficient SSL communication enforcement
wordpress: insufficient SSL communication enforcement
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
GHSA
GHSA-f6wq-25v5-wmh5: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template
ghsa_unreviewed·2022-05-02
CVE-2008-3747 [HIGH] GHSA-f6wq-25v5-wmh5: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
OSV
CVE-2008-3747: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template
osv·2008-08-27·CVSS 7.5
CVE-2008-3747 [HIGH] CVE-2008-3747: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
No detection rules found.
No public exploits indexed.
http://trac.wordpress.org/ticket/7359http://www.openwall.com/lists/oss-security/2008/08/19/1http://www.openwall.com/lists/oss-security/2008/08/20/3http://www.securityfocus.com/bid/30750https://exchange.xforce.ibmcloud.com/vulnerabilities/44569http://trac.wordpress.org/ticket/7359http://www.openwall.com/lists/oss-security/2008/08/19/1http://www.openwall.com/lists/oss-security/2008/08/20/3http://www.securityfocus.com/bid/30750https://exchange.xforce.ibmcloud.com/vulnerabilities/44569
2008-08-27
Published