Vulnerability CVE-2012-0782

Vulnerability Name:

CVE-2012-0782 (CCN-72710)

Assigned:

2012-01-24

Published:

2012-01-24

Updated:

2012-01-31

Summary:

** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter.
Note: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Gain Access

References:

Source: BUGTRAQ
Type: Exploit
20120124 TWSL2012-002: Multiple Vulnerabilities in WordPress

Source: MITRE
Type: CNA
CVE-2012-0782

Source: CCN
Type: WordPress Web Site
WordPress Blog Tool, Publishing Platform, and CMS

Source: EXPLOIT-DB
Type: Exploit
18417

Source: CCN
Type: OSVDB ID: 78709
WordPress wp-admin/setup-config.php Multiple Parameter XSS

Source: XF
Type: UNKNOWN
wp-setupconfig-xss(72710)

Source: CCN
Type: TWSL2012-002
Multiple Vulnerabilities in WordPress

Source: MISC
Type: Exploit
https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt

Vulnerable Configuration:

Configuration 1:

cpe:/a:wordpress:wordpress:0.7:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.71:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.72:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:0.711:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:1.5.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.5:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.6:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.7:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.8:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.9:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.10:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.0.11:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.1.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.5:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.6:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.6.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.6.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.6.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.6.5:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.7:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.7.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.5:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.8.6:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.9:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.9.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:2.9.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.5:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.6:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:* (Version <= 3.3.1)

Configuration CCN 1:

cpe:/a:wordpress:wordpress:3.3.1:*:*:*:*:*:*:*

AND

cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201207820000000	V	CVE-2012-0782 on Ubuntu 18.04 LTS (bionic) - low.	2012-01-30
oval:com.ubuntu.artful:def:20120782000	V	CVE-2012-0782 on Ubuntu 17.10 (artful) - low.	2012-01-30
oval:com.ubuntu.trusty:def:20120782000	V	CVE-2012-0782 on Ubuntu 14.04 LTS (trusty) - low.	2012-01-30
oval:com.ubuntu.xenial:def:201207820000000	V	CVE-2012-0782 on Ubuntu 16.04 LTS (xenial) - low.	2012-01-30
oval:com.ubuntu.bionic:def:20120782000	V	CVE-2012-0782 on Ubuntu 18.04 LTS (bionic) - low.	2012-01-30
oval:com.ubuntu.xenial:def:20120782000	V	CVE-2012-0782 on Ubuntu 16.04 LTS (xenial) - low.	2012-01-30
oval:com.ubuntu.disco:def:201207820000000	V	CVE-2012-0782 on Ubuntu 19.04 (disco) - low.	2012-01-30
oval:com.ubuntu.cosmic:def:20120782000	V	CVE-2012-0782 on Ubuntu 18.10 (cosmic) - low.	2012-01-30
oval:com.ubuntu.cosmic:def:201207820000000	V	CVE-2012-0782 on Ubuntu 18.10 (cosmic) - low.	2012-01-30
oval:com.ubuntu.precise:def:20120782000	V	CVE-2012-0782 on Ubuntu 12.04 LTS (precise) - low.	2012-01-30

BACK