CVE-2010-5297
published 2014-01-21CVE-2010-5297: WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might…
PriorityP413low2.1CVSS 2.0
AVNACHAuSCNIPAN
EPSS
2.21%
80.7th percentile
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 3.0.1-1 (bookworm) | wordpress 3.0.1-1 (bookworm) |
| wordpress | wordpress | <= 3.0 | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
CVSS provenance
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:P/A:N
osv2.1LOW
vendor_debian2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8cg5-rjxh-5v62: WordPress before 3
ghsa_unreviewed·2022-05-17
CVE-2010-5297 [LOW] GHSA-8cg5-rjxh-5v62: WordPress before 3
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
OSV
CVE-2010-5297: WordPress before 3
osv·2014-01-21·CVSS 2.1
CVE-2010-5297 [LOW] CVE-2010-5297: WordPress before 3
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Debian
CVE-2010-5297: wordpress - WordPress before 3.0.1, when a Multisite installation is used, permanently retai...
vendor_debian·2010·CVSS 2.1
CVE-2010-5297 [LOW] CVE-2010-5297: wordpress - WordPress before 3.0.1, when a Multisite installation is used, permanently retai...
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Scope: local
bookworm: resolved (fixed in 3.0.1-1)
bullseye: resolved (fixed in 3.0.1-1)
forky: resolved (fixed in 3.0.1-1)
sid: resolved (fixed in 3.0.1-1)
trixie: resolved (fixed in 3.0.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://codex.wordpress.org/Changelog/3.0.1http://core.trac.wordpress.org/query?status=closed&group=resolution&order=priority&milestone=3.0.1&resolution=fixedhttps://core.trac.wordpress.org/changeset/15342https://core.trac.wordpress.org/ticket/14119http://codex.wordpress.org/Changelog/3.0.1http://core.trac.wordpress.org/query?status=closed&group=resolution&order=priority&milestone=3.0.1&resolution=fixedhttps://core.trac.wordpress.org/changeset/15342https://core.trac.wordpress.org/ticket/14119
2014-01-21
Published