CVE-2012-2404: XSS
Published Apr 21, 2012
·Updated
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Affected Software
80 affected components
WordPress<=3.3.1
WordPress=0.71
WordPress=1.0
WordPress=1.0.1
WordPress=1.0.2
WordPress=1.1.1
WordPress=1.2
WordPress=1.2.1
WordPress=1.2.2
WordPress=1.2.3
WordPress=1.2.4
WordPress=1.2.5
WordPress=1.2.5-a
WordPress=1.3
WordPress=1.3.2
WordPress=1.3.3
WordPress=1.5
WordPress=1.5.1
WordPress=1.5.1.1
WordPress=1.5.1.2
WordPress=1.5.1.3
WordPress=1.5.2
WordPress=2.0
WordPress=2.0.1
WordPress=2.0.2
WordPress=2.0.4
WordPress=2.0.5
WordPress=2.0.6
WordPress=2.0.7
WordPress=2.0.8
WordPress=2.0.9
WordPress=2.0.10
WordPress=2.0.11
WordPress=2.1
WordPress=2.1.1
WordPress=2.1.2
WordPress=2.1.3
WordPress=2.2
WordPress=2.2.1
WordPress=2.2.2
WordPress=2.2.3
WordPress=2.3
WordPress=2.3.1
WordPress=2.3.2
WordPress=2.3.3
WordPress=2.5
WordPress=2.5.1
WordPress=2.6
WordPress=2.6.1
WordPress=2.6.2
WordPress=2.6.3
WordPress=2.6.5
WordPress=2.7
WordPress=2.7.1
WordPress=2.8
WordPress=2.8.1
WordPress=2.8.2
WordPress=2.8.3
WordPress=2.8.4
WordPress=2.8.4-a
WordPress=2.8.5
WordPress=2.8.5.1
WordPress=2.8.5.2
WordPress=2.8.6
WordPress=2.9
WordPress=2.9.1
WordPress=2.9.1.1
WordPress=2.9.2
WordPress=3.0
WordPress=3.0.1
WordPress=3.0.2
WordPress=3.0.3
WordPress=3.0.4
WordPress=3.0.5
WordPress=3.0.6
WordPress=3.1
WordPress=3.1.1
WordPress=3.1.2
WordPress=3.1.3
WordPress=3.3
Remediation
Patch Available
Event History
Apr 21, 2012
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2404?
CVE-2012-2404 has a moderate severity rating, as it allows for potential cross-site scripting (XSS) attacks.
2
How do I fix CVE-2012-2404?
To fix CVE-2012-2404, you should upgrade to WordPress version 3.3.2 or later.
3
Which versions of WordPress are affected by CVE-2012-2404?
CVE-2012-2404 affects all versions of WordPress prior to 3.3.2, including versions from 0.71 up to 3.3.1.
4
What type of vulnerability is CVE-2012-2404?
CVE-2012-2404 is classified as a cross-site scripting (XSS) vulnerability.
5
Can CVE-2012-2404 lead to serious consequences?
Yes, if exploited, CVE-2012-2404 can allow attackers to execute malicious scripts in the context of the affected user's session.