Re: CVE-request: WordPress 3.1.1

[Kurt Seifried <kseifried () redhat com>]

On 01/15/2012 07:39 AM, Henri Salo wrote:
> On Sun, Jan 15, 2012 at 03:32:48PM +0100, Hanno Böck wrote:
> > > 1) Certain unspecified input is not properly sanitised before being
> > > returned to the user. This can be exploited to execute arbitrary HTML
> > > and script code in a user's browser session in context of an affected
> > > site. http://osvdb.org/show/osvdb/72141
> > I think this is CVE-2012-0287:
> > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0287
> I think you are correct. I do not know why I did not see this in allitems.txt.gz. Can't find other CVEs with that 
> URL. There seems to be three issues. I am refering to http://wordpress.org/news/2011/04/wordpress-3-1-1/:
>
> "Version 3.1.1 also addresses three security issues discovered by WordPress core developers Jon Cave and Peter 
> Westwood, of our security team. The first hardens CSRF prevention in the media uploader. The second avoids a PHP 
> crash in certain environments when handling devilishly devised links in comments, and the third addresses an XSS 
> flaw."
>
> ======================================================
> Name: CVE-2012-0287
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0287
> Phase: Assigned (20120103)
> Category: 
> Reference: MISC:http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html
> Reference: CONFIRM:https://wordpress.org/news/2012/01/wordpress-3-3-1/
>
> Cross-site scripting (XSS) vulnerability in wp-comments-post.php in
> WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows
> remote attackers to inject arbitrary web script or HTML via the query
> string in a POST operation that is not properly handled by the
> "Duplicate comment detected" feature.
>
>
> Current Votes:
> None (candidate not yet proposed)
> ======================================================
>
> - Henri Salo
I don't feel assigning a CVE for these issues would be prudent until
some details are released, I think the 3.1.1 and 3.1.3 stuff is separate
but I can't be sure. Can someone from WordPress comment?

-- 

-- Kurt Seifried / Red Hat Security Response Team