WP-Super-Cache 1.3.1 Remote Code Exec

2013.04.25
Credit: Kurt Seifried
Risk: High
Local: No
Remote: Yes
CVE: CVE-2013-2011
CWE: CWE-116


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

So it turns out the attempted fix for CVE-2013-2009 was incomplete. To quote reddit: "Erm, you forgot about escaping markdown metachars. Here, the fixed version, edit it in: \*\^_\^\*" http://www.reddit.com/r/netsec/comments/1czzyx/update_wp_super_cache_and_w3tc_immediately_remote/c9lvxn8 And to quote the WP-Super-Cache 1.3.2 ChangeLog: += 1.3.2 = +* Any mfunc/mclude/dynamic-cached-content tags in comments are now removed. So please use CVE-2013-2011 for this issue. NOTE: this issue exists because of an incomplete fix for CVE-2013-2009. - -- Kurt Seifried Red Hat Security Response Team (SRT)

References:

http://seclists.org/oss-sec/2013/q2/182
http://cxsecurity.com/issue/WLB-2013040173


See this note in RAW Version
Vote for this issue:
50%
50%

Comment it here.
Copyright 2025, cxsecurity.com

 

Back to Top