Source: wordpress Version: 6.2+dfsg1-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 6.1.1+dfsg1-1
Hi, The following vulnerability was published for wordpress. CVE-2023-2745[0]: | WordPress Core is vulnerable to Directory Traversal in versions up to, | and including, 6.2, via the &#8216;wp_lang&#8217; parameter. | This allows unauthenticated attackers to access and load arbitrary | translation files. In cases where an attacker is able to upload a | crafted translation file onto the site, such as via an upload form, | this could be also used to perform a Cross-Site Scripting attack. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-2745 https://www.cve.org/CVERecord?id=CVE-2023-2745 [1] https://core.trac.wordpress.org/changeset?old=55765&new=55765 [2] https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/ Regards, Salvatore
