Bug 420571 (CVE-2012-2404)

Summary:	<www-apps/wordpress-3.3.2: XSS in redirects after posting comments. (CVE-2012-2404)
Product:	Gentoo Security	Reporter:	the_eccentric
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://core.trac.wordpress.org/changeset/20486/branches/3.3/wp-comments-post.php
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description the_eccentric 2012-06-10 19:05:56 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-2404 to the following vulnerability:

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

References:
http://core.trac.wordpress.org/changeset/20486/branches/3.3/wp-comments-post.php
http://wordpress.org/news/2012/04/wordpress-3-3-2/

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2012-06-10 22:58:41 UTC

Fixed package is already in the tree. 

the_eccentric, there is no need to mark the bug private if the reference URLs are already public at known locations.