Description

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

Remediation

References

CVE-2013-0235

Related Vulnerabilities

WordPress Plugin Limit Login Attempts Cross-Site Scripting (4.0.43)

ownCloud Other Vulnerability (CVE-2014-2056)

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Information Disclosure (2.7.6)

Django Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33571)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-4025)

Severity

Medium

Classification

CVE-2013-0235

Tags

Missing Update Known Vulnerabilities