Cross-site scripting in WordPress - CVE-2012-3383
Published: July 22, 2012 / Updated: November 1, 2020
Vulnerability identifier: #VU43798
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-3383
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: WordPress.ORG
Affected software:
WordPress
WordPress
Detailed vulnerability description
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
How to mitigate CVE-2012-3383
Install update from vendor's website.
Sources
- http://codex.wordpress.org/Version_3.4.1
- http://codex.wordpress.org/Version_3.4.2
- http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23
- http://core.trac.wordpress.org/changeset?reponame=&new=21153%40branches%2F3.4&old=21076%40trunk#file16
- http://openwall.com/lists/oss-security/2012/09/12/17
- http://www.openwall.com/lists/oss-security/2012/07/02/1
- http://www.openwall.com/lists/oss-security/2012/07/08/1