Description

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

Remediation

References

CVE-2011-3127

Related Vulnerabilities

PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2006-0208)

Oracle Database Server CVE-2012-3134 Vulnerability (CVE-2012-3134)

WordPress Plugin BackupBuddy Information Disclosure (2.2.28)

WordPress Plugin WP Inventory Manager Cross-Site Scripting (1.7.8)

Drupal Core 4.6.x Multiple Cross-Site Scripting Vulnerabilities (4.6.0 - 4.6.9)

Severity

Medium

Classification

CVE-2011-3127 CWE-20

Tags

Missing Update Known Vulnerabilities