WordPress 3.6.0 wp-admin/edit-tags.php _wp_http_referer/_wp_original_http_referer Reflected cross site scripting

Summaryinfo

A vulnerability was found in WordPress 3.6.0. It has been declared as problematic. The affected element is an unknown function of the file wp-admin/edit-tags.php. The manipulation of the argument _wp_http_referer/_wp_original_http_referer results in cross site scripting (Reflected). The attack can be executed remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in WordPress 3.6.0 (Content Management System). Affected is some unknown processing of the file wp-admin/edit-tags.php. The manipulation of the argument _wp_http_referer/_wp_original_http_referer with an unknown input leads to a cross site scripting vulnerability (Reflected). CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 12/19/2013 by MustLive as URL Redirector Abuse ?? XSS ??????????? ? WordPress as confirmed advisory (Website). The advisory is shared for download at websecurity.com.ua. The public release happened without coordination with the vendor. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

A public exploit has been developed by MustLive in HTTP Request and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. By approaching the search of inurl:wp-admin/edit-tags.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.6.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (90149) and OSVDB (101182†). Entry connected to this vulnerability is available at VDB-11555. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• WordPress

Version

• 3.6.0

License

• open-source

Website

• Product: https://wordpress.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion