Lucene search

[email protected]CVE-2013-5738

HistorySep 12, 2013 - 1:30 p.m.

CVE-2013-5738

2013-09-1213:30:13

CWE-20

[email protected]

web.nvd.nist.gov

wordpress

get_allowed_mime_types

functions.php

xss

cve-2013-5738

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.1

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.

Affected configurations

NVD

Node

wordpresswordpressRange≤3.6

VendorProductVersionCPE
wordpresswordpresscpe:/a:wordpress:wordpress::::

Vendor	Product	Version	CPE
wordpress	wordpress		cpe:/a:wordpress:wordpress::::

References

codex.wordpress.org/Version_3.6.1

core.trac.wordpress.org/changeset/25322

wordpress.org/news/2013/09/wordpress-3-6-1/

www.debian.org/security/2013/dsa-2757

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.1

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2013-5738

ubuntucve1 cvelist1 prion1 wpvulndb1 nvd1 patchstack1 seebug1 debiancve1 nessus5 openvas3 freebsd1 mageia1 osv1 debian1 securityvulns2