CVE-2013-2199: XSS

On Friday, 2013-06-21 WordPress upstream is about to release new WordPress v3.5.2 version, correcting the following security flaws:

CVE-2013-2199 - SSRF, multiple vulnerabilities:

Inadequate SSRF protection for HTTP requests where the user can provide a URL can allow for attacks against the intranet and other sites. This is a continuation of work related to CVE-2013-0235, which was specific to SSRF in pingback requests and was fixed in 3.5.1.

CVE-2013-2200 - Privilege escalation allowing contributors to publish posts:

Inadequate checking of a user's capabilities could allow them to publish posts when their user role should not allow for it; and to assign posts to other authors.

CVE-2013-2201 - XSS, multiple vulnerabilities:

Inadequate escaping allowed an administrator to trigger a cross-site scripting vulnerability through the uploading of media files and plugins.

CVE-2013-2202 - XXE via oEmbed:

The processing of an oEmbed response is vulnerable to an XXE.

CVE-2013-2203 - Full Path Disclosure during File Upload:

If the uploads directory is not writable, error message data returned via XHR will include a full path to the directory.

And two security flaws in external products:

CVE-2013-2204 - Content Spoofing in the MoxieCode (TinyMCE) MoxiePlayer project: Upstream patch: https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2

CVE-2013-2205 - Cross-domain XSS in SWFUpload (again): Fix: Removing security.allowDomain("") and only allow access from the same domain.