WordPress up to 3.8.1 Media Manager Description Field Stored cross site scripting

Summaryinfo

A vulnerability was found in WordPress up to 3.8.1. It has been classified as problematic. Affected is an unknown function of the component Media Manager. The manipulation leads to cross site scripting (Description Field Stored). The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in WordPress up to 3.8.1 (Content Management System). This issue affects an unknown code block of the component Media Manager. The manipulation with an unknown input leads to a cross site scripting vulnerability (Description Field Stored). Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is confidentiality, integrity, and availability.

The weakness was presented 02/01/2014 by Larry W. Cashdollar (@_larry0) with Vapid Labs as Title: Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4) as not defined exploit (Website). It is possible to read the advisory at vapid.dhs.org. The vendor was not involved in the public release. The exploitation is known to be easy. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

A public exploit has been developed by Larry W. Cashdollar (@_larry0) in Java and been published immediately after the advisory. The exploit is available at vapid.dhs.org. It is declared as functional.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (102763†). twitter.com is providing further details. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• WordPress

Version

• 3.3.1
• 3.3.2
• 3.3.3
• 3.4
• 3.4.1
• 3.4.2
• 3.5
• 3.5.1
• 3.5.2
• 3.6
• 3.6.1
• 3.7
• 3.7.1
• 3.8
• 3.8.1

License

• open-source

Website

• Product: https://wordpress.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion