Re: CVE Request -- Wordpress v3.0.2 SQL injection flaw + two minor XSS issues

[Josh Bressers <bressers () redhat com>]

----- "Jan Lieskovsky" <jlieskov () redhat com> wrote:

> Hello Steve, vendors,
>
>    Wordpress upstream has released latest v3.0.2 version, addressing
> one SQL injection
> flaw:
>
>    1), SQL injection flaw by processing trackbacks
>
>    An improper input sanitization flaw was found in the way Wordpress
> performed trackbacks (a way to notify a website when an entry that
> references it is published) maintainance. A remote attacker,
> with Author-level privilege could use this flaw to conduct
> SQL injection attacks (gain further access to the site, which
> should be otherwise prohibited).
>
>    References:
>    [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605603
>    [2] http://codex.wordpress.org/Version_3.0.2
>    [3] http://core.trac.wordpress.org/changeset/16625
>    [4] https://bugzilla.redhat.com/show_bug.cgi?id=659265

Use CVE-2010-4257 for the SQL injection flaw.

I'm less sure about the other two.

> The two XSS issues below are minor, as they need Wordpress administrator
> to perform the attack, but according to CVE philosophy, the CVE ids
> should be assigned for them too. But these two opened / left for further
> discussion:
>
>    2), XSS in requesting user credentials in order to connect to the
> filesystem
>    References:
>    [7] https://bugzilla.redhat.com/show_bug.cgi?id=659294
>    [8] http://codex.wordpress.org/Version_3.0.2
>    [9] http://core.trac.wordpress.org/changeset/16367
>
>    3), XSS when deleting a plugin
>    References:
>    [10] https://bugzilla.redhat.com/show_bug.cgi?id=659299
>    [11] http://codex.wordpress.org/Version_3.0.2
>    [12] http://core.trac.wordpress.org/changeset/16373
>
> Note: The other issues mentioned in:
>        http://codex.wordpress.org/Version_3.0.2
>
>        should be only bugfixes.

Do these two XSS flaws cross a trust boundary? I'm not familiar with
wordpress.

I looked back at previous wordpress admin related issues, there were none
like this. Most XSS things affecting the admin involved an xss that affects
the admin, not one triggered by an admin.

Thanks.

-- 
    JB