Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-0235 — Server-Side Request Forgery in Wordpress

15 documents6 sources
Severity
6.4MEDIUMNVD
NVD4.3
EPSS
58.4%
top 1.80%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedJul 8
Latest updateMay 17

Description

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 3.5.1+dfsg-1 (bookworm)+1
▶Debianwordpress/wordpress< 3.5.2+dfsg-1+7
▶NVDwordpress/wordpress3.5.1+75

Patches

Patch: core.trac.wordpress.org ↗Patch: core.trac.wordpress.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-7372-64f4-g53c: The HTTP API in WordPress before 3↗2022-05-17
▶
GHSA
GHSA-h9g4-hjrv-3hqw: The XMLRPC API in WordPress before 3↗2022-05-05
▶
OSV
CVE-2013-2199: The HTTP API in WordPress before 3↗2013-07-08
▶
OSV
CVE-2013-0235: The XMLRPC API in WordPress before 3↗2013-07-08
▶

💥Exploits & PoCs

1
Metasploit
Wordpress Pingback Locator↗
▶

📋Vendor Advisories

2
Debian
CVE-2013-0235: wordpress - The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP re...↗2013
▶
Debian
CVE-2013-2199: wordpress - The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requ...↗2013
▶

💬Community

5
Bugzilla
CVE-2014-0235 php: file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]↗2014-06-30
▶
Bugzilla
CVE-2013-2199 CVE-2013-2200 CVE-2013-2201 CVE-2013-2202 CVE-2013-2203 CVE-2013-2204 CVE-2013-2205 wordpress: Multiple security flaws to be corrected within upstream 3.5.2 version↗2013-06-21
▶
Bugzilla
CVE-2013-0235 wordpress: Server-side request forgery and remote port scanning using pingbacks↗2013-01-25
▶
Bugzilla
CVE-2013-0235 CVE-2013-0236 CVE-2013-0237 wordpress various flaws [fedora-all]↗2013-01-25
▶
Bugzilla
CVE-2013-0235 CVE-2013-0236 CVE-2013-0237 wordpress various flaws [epel-all]↗2013-01-25
▶
CVE-2013-0235 — Server-Side Request Forgery | cvebase