Bug 471989 - (CVE-2008-5113) CVE-2008-5113 wordpress delayed attack via cookies
CVE-2008-5113 wordpress delayed attack via cookies
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 471990 471991 471992
  Show dependency treegraph
Reported: 2008-11-17 20:47 EST by Josh Bressers
Modified: 2010-12-23 21:13 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-12-23 21:13:00 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2008-11-17 20:47:16 EST
WordPress 2.6.3 relies on the REQUEST superglobal array in certain
dangerous situations, which makes it easier for remote attackers to
conduct delayed and persistent cross-site request forgery (CSRF)
attacks via crafted cookies, as demonstrated by attacks that (1)
delete user accounts or (2) cause a denial of service (loss of
application access). NOTE: this issue relies on the presence of an
independent vulnerability that allows cookie injection.

Comment 1 Josh Bressers 2008-11-17 20:47:48 EST
Created wordpress tracking bugs for this issue

CVE-2008-5113 Affects: F8 [bug #471990]
CVE-2008-5113 Affects: F9 [bug #471991]
CVE-2008-5113 Affects: Fdevel [bug #471992]
Comment 3 Adrian Reber 2008-11-25 13:40:12 EST
2.6.5 is available which seems to fix the security vulnerability


They do not mention the CVE number as far as I see it but the changes to feed.php
seems to change the behaviour concerning the REQUEST variable:


I will push updates for wordpress.
Comment 4 Tomas Hoger 2008-11-26 03:57:45 EST
From this quick look at the 2.6.3 -> 2.6.5 changeset, I fail to see any change that may be possibly related to this issue.  $_REQUEST still seems widely used in 2.6.5, feed.php is unlikely to be the only place to be affected.  Please do not mention this bug/CVE in the 2.6.5 update request.
Comment 5 Vincent Danen 2010-12-23 21:13:00 EST
According to http://codex.wordpress.org/CVEs#2008 this only affected 2.6.3.

Note You need to log in before you can comment on or make changes to this bug.