Description

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

Remediation

References

CVE-2013-0235

Related Vulnerabilities

WordPress Plugin Easy Social Box/Page Cross-Site Scripting (4.1.2)

WordPress Plugin Zedna Contact form Arbitrary File Upload (1.0)

WordPress Plugin Master Slider-WordPress Responsive Touch Slider Unspecified Vulnerability (2.18.2)

e107 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2006-0857)

PHP Uncontrolled Resource Consumption Vulnerability (CVE-2011-3336)

Severity

Medium

Classification

CVE-2013-0235

Tags

Missing Update Known Vulnerabilities