Executive Summary
This vulnerability is currently undergoing analysis and not all information is available. Please check back soon to view the completed vulnerability summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2013-0235 | First vendor Publication | 2013-07-08 |
| Vendor | Cve | Last vendor Modification | 2013-07-08 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0235 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:19614 | |||
| Oval ID: | oval:org.mitre.oval:def:19614 | ||
| Title: | DSA-2718-1 wordpress - several | ||
| Description: | Several vulnerabilities were identified in WordPress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the wordpress package to the latest upstream version instead of backporting the patches. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2718-1 CVE-2013-2173 CVE-2013-2199 CVE-2013-2200 CVE-2013-2201 CVE-2013-2202 CVE-2013-2203 CVE-2013-2204 CVE-2013-2205 CVE-2013-0235 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | wordpress |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2017-01-04 | WordPress XMLRPC pingback ddos attempt RuleID : 40883 - Revision : 3 - Type : SERVER-WEBAPP |
| 2014-01-10 | WordPress XMLRPC potential port-scan attempt RuleID : 28849 - Revision : 4 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2718.nasl - Type : ACT_GATHER_INFO |
| 2013-07-03 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2013-189.nasl - Type : ACT_GATHER_INFO |
| 2013-02-11 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1692.nasl - Type : ACT_GATHER_INFO |
| 2013-02-11 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1774.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote web server contains a PHP application that is affected by multiple... File : wordpress_3_5_1.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote web server contains a PHP application that is affected by a server... File : wordpress_xmlrpc_pingback_request_forgery.nasl - Type : ACT_ATTACK |
| 2013-01-30 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_559e00b76a4d11e2b6b010bf48230856.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:01 |
|
| 2019-05-10 12:05:06 |
|
| 2019-02-28 12:04:48 |
|
| 2017-11-17 12:03:19 |
|
| 2017-09-29 12:03:57 |
|
| 2016-04-26 22:39:40 |
|
| 2014-02-17 11:15:26 |
|
| 2014-01-19 21:29:07 |
|
| 2013-07-09 13:19:13 |
|
