CVE-2007-4893: CSRF

Published Sep 14, 2007

Updated

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfilteredhtml privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a nofilter field.

Affected Software

31 affected components

WordPress=0.6.2

WordPress=0.6.2.1

WordPress=0.7

WordPress=0.71

WordPress=1.2

WordPress=1.2.1

WordPress=1.2.2

WordPress=1.5

WordPress=1.5.1

WordPress=1.5.1.2

WordPress=1.5.1.3

WordPress=2.0

WordPress=2.0.1

WordPress=2.0.2

WordPress=2.0.3

WordPress=2.0.4

WordPress=2.0.5

WordPress=2.0.6

WordPress=2.0.7

WordPress=2.0.10_rc1

WordPress=2.0.10_rc2

WordPress=2.1.1

WordPress=2.1.2

WordPress=2.1.3

WordPress=2.1.3_rc1

WordPress=2.1.3_rc2

WordPress=2.2

WordPress=2.2.1

WordPress=2.2.2

WordPress=2.2_revision5002

WordPress=2.2_revision5003

Event History

Sep 14, 2007

CVE Published

06:17 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4893?

CVE-2007-4893 has a medium severity rating due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2007-4893?

To fix CVE-2007-4893, upgrade to WordPress version 2.2.3 or later.

What versions of WordPress are affected by CVE-2007-4893?

CVE-2007-4893 affects WordPress versions before 2.2.3 and WordPress multi-user (MU) versions before 1.2.5a.

What type of attack can CVE-2007-4893 allow?

CVE-2007-4893 can allow remote attackers to conduct cross-site scripting (XSS) attacks.

Is there a workaround for CVE-2007-4893?

There is no official workaround; the ONLY solution is to update to a patched version of WordPress.