wordpress: multiple vulnerabilities [LWN.net]

Package(s):

wordpress

CVE #(s):

CVE-2009-2854 CVE-2009-2851 CVE-2009-2853

Created:

August 24, 2009

Updated:

August 28, 2009

Description:

From the Debian advisory:

CVE-2009-2854: It was discovered that wordpress lacks authentication checks in various actions, thus allowing remote attackers to produce unauthorised edits or additions.

CVE-2009-2851: It was discovered that the administrator interface is prone to a cross-site scripting attack.

CVE-2009-2853: It was discovered that remote attackers can gain privileges via certain direct requests.

Alerts:

Debian	DSA-1871-2	wordpress	2009-08-27
Debian	DSA-1871-1	wordpress	2009-08-23

to post comments

Broken links

Posted Aug 28, 2009 12:10 UTC (Fri) by ajk (guest, #6607) [Link] (8 responses)

The CVE links in this and several other posts appear to be broken.

(I didn't find any email address where I could have reported this, so doing it publically.)

Broken links

Posted Aug 28, 2009 13:11 UTC (Fri) by corbet (editor, #1) [Link] (7 responses)

1) They are working for me. The Mitre folks recently broke links to www.cve.mitre.org, but we fixed that a couple of days ago so you shouldn't have been seeing it.

2) The LWN.net FAQ, as listed in the upper-right corner of the page, includes contact addresses.

Broken links

Posted Aug 28, 2009 13:19 UTC (Fri) by ajk (guest, #6607) [Link] (6 responses)

The links on this page are working noticed that after posting. I noticed the problem on http://lwn.net/Articles/347814/ and (reasonably, I'd think) assumed that both pages are generated from the same data and thus would not differ on this.

As to the FAQ I did have a look there. Dunno why I missed the addresses.

Broken links

Posted Aug 28, 2009 13:28 UTC (Fri) by corbet (editor, #1) [Link] (3 responses)

Ah, OK, that was a caching problem on our end. We should have thought of that; fixed now.

(But done with an obligatory grumble toward the mitre.org folks who broke URLs that have worked for years...)

Broken links

Posted Aug 28, 2009 15:58 UTC (Fri) by ajk (guest, #6607) [Link] (2 responses)

I'm still seeing the broken links here, even though I've flushed my browser cache, done hard reloads and changed IP addresses (by going home from work) in between.

Broken links

Posted Aug 28, 2009 16:05 UTC (Fri) by corbet (editor, #1) [Link] (1 responses)

AAAAARRRRRRGH!

OK, I know what the problem is. Now it's fixed. Really this time. Honest. I wouldn't mislead you on this. Trust me.

Sorry for the confusion.

Broken links

Posted Aug 28, 2009 16:16 UTC (Fri) by ajk (guest, #6607) [Link]

Confirmed. Thank you :)

Broken links

Posted Aug 28, 2009 13:30 UTC (Fri) by jake (editor, #205) [Link] (1 responses)

> I noticed the problem on http://lwn.net/Articles/347814/ and (reasonably,
> I'd think) assumed that both pages are generated from the same data and
> thus would not differ on this.

Hmm, the half-dozen CVE links I tried on the page you reference seemed to work just fine. You are right, they are generated from the same data, so it would be weird if some weren't working. Can you give a specific example?

thanks!

jake

Broken links

Posted Aug 28, 2009 13:32 UTC (Fri) by jake (editor, #205) [Link]

Oops! Never mind ... :)

jake