Description

WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.

Remediation

References

CVE-2013-4339

Related Vulnerabilities

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-4064)

ATutor Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-11446)

WordPress Plugin Floating Chat Widget:Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button-Chaty SQL Injection (3.0.2)

WordPress Plugin Fancy Product Designer-WooCommerce Arbitrary File Upload (4.6.8)

WordPress Plugin xili-tidy-tags Cross-Site Request Forgery (1.12.03)

Severity

High

Classification

CVE-2013-4339 CWE-20

Tags

Missing Update Known Vulnerabilities