Bug 385687

Summary:	(CVE-2011-3862) <www-apps/wordpress-3.x Morning Coffee Theme URL Cross-Site Scripting Vulnerability
Product:	Gentoo Security	Reporter:	Michael Harrison <n0idx80>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://secunia.com/advisories/46295/
Whiteboard:
Package list:		Runtime testing required:	---

Description Michael Harrison 2011-10-05 06:36:07 UTC

Input appended to the URL after index.php (when the "s" POST parameter is set) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Comment 1 Michael Harrison 2011-10-05 06:53:58 UTC

Wordpress is masked for ~x86 so I won't post anymore, sorry!

Comment 2 Michael Harrison 2011-10-05 07:25:14 UTC

Again, sorry this isn't stable.