WordPress.org

Ready to get started?Download WordPress

Forums

[resolved] Possible Cross Scripting Vulnerability? (8 posts)

  1. kelley_rao
    Member
    Posted 3 years ago #

    Hello,

    I saw a couple of sites hacked today, so did some research and came across this:

    http://seclists.org/bugtraq/2010/Aug/172

    Is this something that is being addressed? What can we do to protect our site, prior to a fix?

    Kelley Rao, Webeze

  2. esmi
    Forum Moderator
    Posted 3 years ago #

    Send an email with the details to security@wordpress.org.

  3. kelley_rao
    Member
    Posted 3 years ago #

    Done!

  4. Andrew Nacin
    Lead Developer
    Posted 3 years ago #

    This was reported to us last week. We're still looking into it and will likely add a sanity check here, though we can currently determine that this is an extremely minor XSS issue and will not compromise an installation.

    For this to work, you would have to be an administrator on a single site install, or a super administrator on a multisite install, rendering the exploit pretty much useless as admins can do anything anyway. We also perform proper capability checks and most importantly a nonce and referer check, so it poses no CSRF or privilege escalation threat unless of course the server is already compromised for both the filesystem and database, at which point you're toast anyway.

  5. Andrew Nacin
    Lead Developer
    Posted 3 years ago #

    For those wondering, this is fixed in WordPress 3.1.

  6. Roy
    Member
    Posted 3 years ago #

    This DOES make me wonder if we can wait for 3.1 or when it that version due?

  7. Andrew Nacin
    Lead Developer
    Posted 3 years ago #

    As explained in my first comment, this vulnerability is simply not exploitable, hence why we're not preparing a version 3.0.2.

    The hacks you're seeing are server-level issues, not application-level. There are no known exploitable security vulnerabilities in WordPress and haven't been in more than a year.

  8. Roy
    Member
    Posted 3 years ago #

    Ah indeed, sorry and thanks.

Topic Closed

This topic has been closed to new replies.

About this Topic

Tags

No tags yet.