Lucene search

[email protected]CVE-2011-4899

HistoryOct 03, 2022 - 4:15 p.m.

CVE-2011-4899

2022-10-0316:15:14

[email protected]

web.nvd.nist.gov

cve-2011-4899

wordpress

security vulnerability

code injection

xss

remote attack

database configuration

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

High

0.039 Low

EPSS

Percentile

92.0%

JSON

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments

Affected configurations

NVD

Node

wordpresswordpressRange≤3.3.1

wordpresswordpressMatch0.7

wordpresswordpressMatch0.71

wordpresswordpressMatch0.72

wordpresswordpressMatch0.711

wordpresswordpressMatch1.0

wordpresswordpressMatch1.0.1

wordpresswordpressMatch1.0.2

wordpresswordpressMatch1.2

wordpresswordpressMatch1.2.1

wordpresswordpressMatch1.2.2

wordpresswordpressMatch1.5

wordpresswordpressMatch1.5.1

wordpresswordpressMatch1.5.1.2

wordpresswordpressMatch1.5.1.3

wordpresswordpressMatch1.5.2

wordpresswordpressMatch2.0

wordpresswordpressMatch2.0.1

wordpresswordpressMatch2.0.2

wordpresswordpressMatch2.0.3

wordpresswordpressMatch2.0.4

wordpresswordpressMatch2.0.5

wordpresswordpressMatch2.0.6

wordpresswordpressMatch2.0.7

wordpresswordpressMatch2.0.8

wordpresswordpressMatch2.0.9

wordpresswordpressMatch2.0.10

wordpresswordpressMatch2.0.11

wordpresswordpressMatch2.1

wordpresswordpressMatch2.1.1

wordpresswordpressMatch2.1.2

wordpresswordpressMatch2.1.3

wordpresswordpressMatch2.2

wordpresswordpressMatch2.2.1

wordpresswordpressMatch2.2.2

wordpresswordpressMatch2.2.3

wordpresswordpressMatch2.3

wordpresswordpressMatch2.3.1

wordpresswordpressMatch2.3.2

wordpresswordpressMatch2.3.3

wordpresswordpressMatch2.5

wordpresswordpressMatch2.5.1

wordpresswordpressMatch2.6

wordpresswordpressMatch2.6.1

wordpresswordpressMatch2.6.2

wordpresswordpressMatch2.6.3

wordpresswordpressMatch2.6.5

wordpresswordpressMatch2.7

wordpresswordpressMatch2.7.1

wordpresswordpressMatch2.8

wordpresswordpressMatch2.8.1

wordpresswordpressMatch2.8.2

wordpresswordpressMatch2.8.3

wordpresswordpressMatch2.8.4

wordpresswordpressMatch2.8.5

wordpresswordpressMatch2.8.6

wordpresswordpressMatch2.9

wordpresswordpressMatch2.9.1

wordpresswordpressMatch2.9.2

wordpresswordpressMatch3.0

wordpresswordpressMatch3.0.1

wordpresswordpressMatch3.0.2

wordpresswordpressMatch3.0.3

wordpresswordpressMatch3.0.4

wordpresswordpressMatch3.0.5

wordpresswordpressMatch3.0.6

wordpresswordpressMatch3.1

wordpresswordpressMatch3.1.1

wordpresswordpressMatch3.1.2

wordpresswordpressMatch3.1.3

wordpresswordpressMatch3.1.4

wordpresswordpressMatch3.2.1

wordpresswordpressMatch3.3

CPENameOperatorVersion
wordpress:wordpresswordpressle3.3.1
wordpress:wordpresswordpresseq0.7
wordpress:wordpresswordpresseq0.71
wordpress:wordpresswordpresseq0.72
wordpress:wordpresswordpresseq0.711
wordpress:wordpresswordpresseq1.0
wordpress:wordpresswordpresseq1.0.1
wordpress:wordpresswordpresseq1.0.2
wordpress:wordpresswordpresseq1.2
wordpress:wordpresswordpresseq1.2.1

CPE	Name	Operator	Version
wordpress:wordpress	wordpress	le	3.3.1
wordpress:wordpress	wordpress	eq	0.7
wordpress:wordpress	wordpress	eq	0.71
wordpress:wordpress	wordpress	eq	0.72
wordpress:wordpress	wordpress	eq	0.711
wordpress:wordpress	wordpress	eq	1.0
wordpress:wordpress	wordpress	eq	1.0.1
wordpress:wordpress	wordpress	eq	1.0.2
wordpress:wordpress	wordpress	eq	1.2
wordpress:wordpress	wordpress	eq	1.2.1