Description

The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.

Remediation

References

CVE-2011-4957

Related Vulnerabilities

MySQL CVE-2020-2759 Vulnerability (CVE-2020-2759)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-44855)

ATutor Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3706)

WordPress Plugin Quick Event Manager Multiple Vulnerabilities (9.7.4)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7985)

Severity

Medium

Classification

CVE-2011-4957 CWE-20

Tags

Missing Update Known Vulnerabilities