Wordpress Wp-login.PHP HTTP响应拆分漏洞

漏洞信息详情

Wordpress Wp-login.PHP HTTP响应拆分漏洞

CNNVD编号：CNNVD-200412-166
危害等级：中危-->
危害等级：中危
CVE编号： CVE-2004-1584
漏洞类型：输入验证
发布时间： 2004-12-31
威胁类型：远程
更新时间： 2005-10-20
厂商： wordpress
漏洞来源： .');">Discovery is credi...

漏洞简介

WordPress 1.2版本的wp-login.php存在CRLF注入漏洞。远程攻击者可以借助文本参数进行HTTP响应拆分攻击，修改服务器预定HTML内容。

漏洞公告

Gentoo Linux has released advisory GLSA 200410-12 dealing with this issue. they have advised that all WordPress users should upgrade to the latest version: # emerge sync # emerge -pv ">=www-apps/wordpress-1.2.1" # emerge ">=www-apps/wordpress-1.2.1" For more information please see the referenced Gentoo advisory. The vendor has released WordPress version 1.2.1 to address this issue. WordPress WordPress 1.2

WordPress WordPress Latest Release Download http://wordpress.org/latest.tar.gz

参考网址

来源: BID 名称: 11348 链接:http://www.securityfocus.com/bid/11348 来源: GENTOO 名称: GLSA-200410-12 链接:http://www.gentoo.org/security/en/glsa/glsa-200410-12.xml 来源: wordpress.org 链接:http://wordpress.org/development/2004/10/wp-121/ 来源: SECUNIA 名称: 12773 链接:http://secunia.com/advisories/12773 来源: BUGTRAQ 名称: 20041006 HTTP Response Splitting Vulnerability in Wordpress 1.2 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109716327724041&w=2 来源: XF 名称: wordpress-response-splitting(17649) 链接:http://xforce.iss.net/xforce/xfdb/17649

受影响实体

Wordpress Wordpress:1.2

补丁

暂无

正文

Wordpress Wp-login.PHP HTTP响应拆分漏洞

漏洞信息详情