CVE-2013-4339

Published: Sep 12, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.

Affected (1)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 3.6

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (20)

http://codex.wordpress.org/Version_3.6.1

Source: secalert@redhat.com

Vendor Advisory

http://core.trac.wordpress.org/changeset/25323

Source: secalert@redhat.com

ExploitPatch

http://core.trac.wordpress.org/changeset/25324

Source: secalert@redhat.com

ExploitPatch

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2013/Dec/174

Source: secalert@redhat.com

http://wordpress.org/news/2013/09/wordpress-3-6-1/

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2013/dsa-2757

Source: secalert@redhat.com

http://www.osvdb.org/101181

Source: secalert@redhat.com

http://codex.wordpress.org/Version_3.6.1