CVE-2007-4153: XSS
First published: Fri Aug 03 2007(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | =2.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://codex.wordpress.org/Roles_and_Capabilities
- http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/
- http://osvdb.org/46994
- http://osvdb.org/46995
- http://secunia.com/advisories/30013
- http://www.debian.org/security/2008/dsa-1564
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35720
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35722
Frequently Asked Questions
What is the severity of CVE-2007-4153?
CVE-2007-4153 is classified as a high severity vulnerability due to its potential for remote code execution through XSS attacks.
How do I fix CVE-2007-4153?
To fix CVE-2007-4153, upgrade WordPress from version 2.2.1 to a later version that has patched the identified XSS vulnerabilities.
Who is affected by CVE-2007-4153?
CVE-2007-4153 affects remote authenticated administrators using WordPress version 2.2.1.
What type of attack is associated with CVE-2007-4153?
CVE-2007-4153 is associated with cross-site scripting (XSS) attacks that can lead to the injection of arbitrary web script or HTML.
Is there a workaround for CVE-2007-4153?
There are no known workarounds for CVE-2007-4153 other than to upgrade to a secure version of WordPress.
- agent/references
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/wordpress
- canonical/wordpress
- version/wordpress/2.2.1