CVE-2009-2851: XSS
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
Other sources
From WordPress blog:
WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.
References: ----------- http://wordpress.org/development/2009/07/wordpress-2-8-2/ http://bugs.gentoo.org/showbug.cgi?id=278492
Note: Please be sure to mention CVE identifier in the WordPress's rpm Changelog when scheduling Fedora updates / addressing this flaw.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2851?
The severity of CVE-2009-2851 is considered medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-2851?
To fix CVE-2009-2851, upgrade your WordPress installation to version 2.8.2 or later.
What types of attacks can CVE-2009-2851 enable?
CVE-2009-2851 can enable remote attackers to execute arbitrary web scripts or HTML through XSS.
Which versions of WordPress are affected by CVE-2009-2851?
CVE-2009-2851 affects all versions of WordPress prior to 2.8.2.
Where is the CVE-2009-2851 vulnerability located?
The CVE-2009-2851 vulnerability is located in the administrator interface of WordPress.