Description

WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2013-2202

Related Vulnerabilities

WordPress Plugin Mobile blocks Security Bypass (1.0)

WordPress Plugin Nokia Maps & Places Cross-Site Scripting (1.6.6)

Apache Tomcat Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-6817)

OpenVPN AS Other Vulnerability (CVE-2005-3393)

Moodle Server-Side Request Forgery (SSRF) Vulnerability (CVE-2022-45152)

Severity

Medium

Classification

CVE-2013-2202 CWE-200

Tags

Missing Update Known Vulnerabilities