CVE-2008-5113: CSRF

Published Nov 17, 2008

Updated

WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.

Affected Software

1 affected component

WordPress=2.6.3

Event History

Nov 17, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-5113?

CVE-2008-5113 is considered a high severity vulnerability due to the potential for remote attackers to exploit it for persistent cross-site request forgery attacks.

How do I fix CVE-2008-5113?

To fix CVE-2008-5113, update WordPress to a version newer than 2.6.3 that addresses this vulnerability.

What versions of WordPress are affected by CVE-2008-5113?

CVE-2008-5113 specifically affects WordPress version 2.6.3.

Can CVE-2008-5113 lead to data loss?

Yes, CVE-2008-5113 can lead to data loss, as attackers may exploit it to delete user accounts.

What type of attack is involved with CVE-2008-5113?

CVE-2008-5113 involves a delayed and persistent cross-site request forgery (CSRF) attack that manipulates the REQUEST superglobal array.