WordPress <= 3.5.1 - External Entity Injection

2013-02-1900:00:00

Jan Lieskovsky

patchstack.com

0.004 Low

EPSS

Percentile

72.2%

JSON

Because of this vulnerability, the attackers can read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference.

Solution

           Update the plugin.

CPENameOperatorVersion
wordpressle3.5.1

CPE	Name	Operator	Version
	wordpress	le	3.5.1

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2202

0.004 Low

EPSS

Percentile

72.2%

JSON

Related for PATCHSTACK:EDB052BFE3C6FE6E63A5FBE379175123