CVE-2008-6762 — Link Following in Wordpress

CWE-59 — Link Following4 documents4 sources

Severity

4.3MEDIUMNVD

EPSS

0.3%

top 47.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedApr 28

Latest updateMay 17

Description

Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 2.8.3-1 (bookworm)

▶Debianwordpress/wordpress< 2.8.3-1+3

▶NVDwordpress/wordpress2.6

🔴Vulnerability Details

GHSA

GHSA-6h65-6827-8qp2: Open redirect vulnerability in wp-admin/upgrade↗2022-05-17

▶

OSV

CVE-2008-6762: Open redirect vulnerability in wp-admin/upgrade↗2009-04-28

▶

📋Vendor Advisories

Debian

CVE-2008-6762: wordpress - Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x...↗2008

▶