Lucene search

[email protected]CVE-2008-5278

HistoryNov 28, 2008 - 7:30 p.m.

CVE-2008-5278

2008-11-2819:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-5278

cross-site scripting

xss vulnerability

wordpress

rss feed generator

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.512 Medium

EPSS

Percentile

97.6%

JSON

Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).

Affected configurations

NVD

Node

wordpresswordpressRange≤2.6.3

wordpresswordpressMatch0.6.2

wordpresswordpressMatch0.6.2beta_2

wordpresswordpressMatch0.6.2.1

wordpresswordpressMatch0.6.2.1beta_2

wordpresswordpressMatch0.7

wordpresswordpressMatch0.71

wordpresswordpressMatch0.71-gold

wordpresswordpressMatch0.72

wordpresswordpressMatch0.72beta1

wordpresswordpressMatch0.72beta2

wordpresswordpressMatch0.72rc1

wordpresswordpressMatch0.711

wordpresswordpressMatch1.0

wordpresswordpressMatch1.0-platinum

wordpresswordpressMatch1.0.1

wordpresswordpressMatch1.0.1-miles

wordpresswordpressMatch1.0.2

wordpresswordpressMatch1.0.2-blakey

wordpresswordpressMatch1.2

wordpresswordpressMatch1.2beta

wordpresswordpressMatch1.2-delta

wordpresswordpressMatch1.2-mingus

wordpresswordpressMatch1.2.1

wordpresswordpressMatch1.2.2

wordpresswordpressMatch1.3.1

wordpresswordpressMatch1.4

wordpresswordpressMatch1.5

wordpresswordpressMatch1.5-strayhorn

wordpresswordpressMatch1.5.1

wordpresswordpressMatch1.5.1.1

wordpresswordpressMatch1.5.1.2

wordpresswordpressMatch1.5.1.3

wordpresswordpressMatch1.5.2

wordpresswordpressMatch1.6

wordpresswordpressMatch2.0

wordpresswordpressMatch2.0.1

wordpresswordpressMatch2.0.2

wordpresswordpressMatch2.0.3

wordpresswordpressMatch2.0.4

wordpresswordpressMatch2.0.5

wordpresswordpressMatch2.0.6

wordpresswordpressMatch2.0.7

wordpresswordpressMatch2.0.8

wordpresswordpressMatch2.0.9

wordpresswordpressMatch2.0.10

wordpresswordpressMatch2.0.10_rc1

wordpresswordpressMatch2.0.10_rc2

wordpresswordpressMatch2.0.11

wordpresswordpressMatch2.1

wordpresswordpressMatch2.1alpha_3

wordpresswordpressMatch2.1.1

wordpresswordpressMatch2.1.2

wordpresswordpressMatch2.1.3

wordpresswordpressMatch2.1.3_rc1

wordpresswordpressMatch2.1.3_rc2

wordpresswordpressMatch2.2

wordpresswordpressMatch2.2.0

wordpresswordpressMatch2.2.1

wordpresswordpressMatch2.2.2

wordpresswordpressMatch2.2.3

wordpresswordpressMatch2.2_revision5002

wordpresswordpressMatch2.2_revision5003

wordpresswordpressMatch2.3

wordpresswordpressMatch2.3beta3

wordpresswordpressMatch2.3rc1

wordpresswordpressMatch2.3.1

wordpresswordpressMatch2.3.1rc1

wordpresswordpressMatch2.3.2

wordpresswordpressMatch2.3.3

wordpresswordpressMatch2.5

wordpresswordpressMatch2.5.1

wordpresswordpressMatch2.6

wordpresswordpressMatch2.6.1

CPENameOperatorVersion
wordpress:wordpresswordpressle2.6.3
wordpress:wordpresswordpresseq0.6.2
wordpress:wordpresswordpresseq0.6.2.1
wordpress:wordpresswordpresseq0.7
wordpress:wordpresswordpresseq0.71
wordpress:wordpresswordpresseq0.71-gold
wordpress:wordpresswordpresseq0.72
wordpress:wordpresswordpresseq0.711
wordpress:wordpresswordpresseq1.0
wordpress:wordpresswordpresseq1.0-platinum

CPE	Name	Operator	Version
wordpress:wordpress	wordpress	le	2.6.3
wordpress:wordpress	wordpress	eq	0.6.2
wordpress:wordpress	wordpress	eq	0.6.2.1
wordpress:wordpress	wordpress	eq	0.7
wordpress:wordpress	wordpress	eq	0.71
wordpress:wordpress	wordpress	eq	0.71-gold
wordpress:wordpress	wordpress	eq	0.72
wordpress:wordpress	wordpress	eq	0.711
wordpress:wordpress	wordpress	eq	1.0
wordpress:wordpress	wordpress	eq	1.0-platinum