CVE-2011-3129 WordPress Core <= 3.1.2 - Arbitrary File Upload
HighCVSS 9.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 3.2.1+dfsg-1 | 3.2.1+dfsg-1 |
| debian/wordpress(Debian:13) | < 3.2.1+dfsg-1 | 3.2.1+dfsg-1 |
| debian/wordpress(Debian:14) | < 3.2.1+dfsg-1 | 3.2.1+dfsg-1 |
| WordPress | = 3.1 | No fix listed |
| WordPress | = 3.1.1 | No fix listed |
| WordPress | = 3.1.2 | No fix listed |
| WordPress | = 3.2-beta1 | No fix listed |
| WordPress(WordPress) | < 3.1.3 | 3.1.3 |
References
- Debian Security Tracker CVE-2011-3129 vendor-advisory
- 49138 third-party-advisory
- wordpress.org patch
- DSA-2470 vendor-advisory
- 47995 vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org