Re: Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4)

[larry Cashdollar <larry0 () me com>]

This issue was reported 17 months ago https://core.trac.wordpress.org/ticket/21917
and can be mitigated by changing the wordpress default configuration.

Sorry folks, I just wanted everyone to know the full story.

Larry C$

> On Feb 2, 2014, at 1:36 PM, "Larry W. Cashdollar" <larry0 () me com> wrote:
>
> Nevermind,  This is invalid.  The WP admin can use javascript while a regular user can not.
>
>
> > On Feb 2, 2014, at 9:56 AM, Larry W. Cashdollar <larry0 () me com> wrote:
> >
> > Title: Persistent XSS in Wordpress 3.3.1+dfsg-1 (Packaged with Ubuntu 12.04.4)
> >
> > Author: Larry W. Cashdollar, @_larry0
> >
> > Date: 2/1/2014
> >
> > Vendor: Not notified yet.
> >
> > Download: http://wordpress.org/download 
> >
> > Versions Impacted: 3.3.1 -> 3.8.1 tested 2/2/2014.
> >
> > CVE: Please assign.
> >
> > Persistent XSS injection description field in Media Library.
> >
> > Description: A persistent cross site scripting vulnerability exists in the latest version of WordPress in the Media 
> > Library.  It appears the Description field is not properly sanitized when viewed.  The malicious code is stored when 
> > the description field is saved.
> >
> > Full Advisory: http://vapid.dhs.org/advisories/wordpress/XSS/xss_wordpress.html