WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2202)

Description

WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Remediation

References

CVE-2013-2202

Related Vulnerabilities

WordPress Ultimate Member Plugin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14946)

Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10002)

WordPress Plugin Cardinity Payment Gateway for WooCommerce Cross-Site Scripting (3.0.6)

Oracle Database Server CVE-2010-4423 Vulnerability (CVE-2010-4423)

XWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-37911)

Severity

Medium

Classification

CVE-2013-2202 CWE-200