WordPress - Redirection URL Validation and Cross-Site Scripting Vulnerabilities
Summary
DLA-1366-1: wordpress - security update. Affects wordpress versions < 3.6.1+dfsg-1~deb7u21. Fixed in 3.6.1+dfsg-1~deb7u21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a popular web blogging tool used for creating and managing websites. It provides a user-friendly interface and a wide range of features for content creation and customization. However, two vulnerabilities have been discovered in WordPress that could potentially compromise the security of the system.
Vulnerability Detail
The first vulnerability, identified as CVE-2018-10100, involves the redirection URL for the login page. The URL was not properly validated or sanitized when forced to use HTTPS, which could allow an attacker to manipulate the redirection and potentially perform phishing attacks or redirect users to malicious websites.
The second vulnerability, known as CVE-2018-10102, relates to the version string in the get_the_generator function. The version string was not properly escaped, leading to a cross-site scripting (XSS) vulnerability in the generator tag. This could enable an attacker to inject malicious code into the website and potentially steal sensitive information or perform other malicious actions.
How To Fix
Minimum fixed version
3.6.1+dfsg-1~deb7u21
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, these vulnerabilities in WordPress could potentially compromise the security of your website. It is crucial to upgrade your WordPress installation to the latest version to ensure the necessary patches are applied and protect your website from potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wordpress →
FAQ
WordPress is a web blogging tool used for creating and managing websites. It provides a user-friendly interface and a wide range of features for content creation and customization.
CVE-2018-10100 is a vulnerability in WordPress that involves the redirection URL for the login page. It allows an attacker to manipulate the redirection and potentially perform phishing attacks or redirect users to malicious websites.
CVE-2018-10102 is a vulnerability in WordPress that relates to the version string in the get_the_generator function. It allows an attacker to inject malicious code into the website and potentially steal sensitive information or perform other malicious actions.
To fix these vulnerabilities, you should upgrade your WordPress installation to version 3.6.1+dfsg-1~deb7u21 or later. This update includes the necessary patches to address the identified issues and ensure the security of your WordPress website.
You can find more information about WordPress security on the official WordPress website or by referring to the Debian LTS security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
