CVE-2006-1796

Severity

68%

Complexity

86%

Confidentiality

106%

The vulnerability manifests itself only when viewed by IE. This vulnerability is addressed in the following product release: Wordpress 2.0.1-1

Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).

The vulnerability manifests itself only when viewed by IE. This vulnerability is addressed in the following product release: Wordpress 2.0.1-1

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

First reported 18 years ago

2006-04-17 20:06:00

Last updated 16 years ago

2008-09-05 21:02:00

Affected Software

WordPress 0.71

0.71

WordPress 1.0

1.0

WordPress 1.0.1

1.0.1

WordPress 1.0.2

1.0.2

WordPress 1.2

1.2

WordPress 1.2.1

1.2.1

WordPress 1.2.2

1.2.2

WordPress 1.5

1.5

WordPress 1.5.1

1.5.1

WordPress 1.5.1.2

1.5.1.2

WordPress 1.5.1.3

1.5.1.3

WordPress 1.5.2

1.5.2

WordPress

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328909

Patch

http://trac.wordpress.org/ticket/1686