CVE-2008-3747

The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.

Link	Resource
http://www.openwall.com/lists/oss-security/2008/08/19/1
http://www.openwall.com/lists/oss-security/2008/08/20/3
http://trac.wordpress.org/ticket/7359	Patch
http://www.securityfocus.com/bid/30750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44569

Configuration 1

cpe:2.3:a:wordpress:wordpress:2.0.11:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3.1:rc1:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2:beta:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.6:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.711:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.6.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.7:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.72:beta2:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.7:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.71:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.6.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.9:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.72:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.5.1:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.72:rc1:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3:beta3:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.5:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.0.10:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.0:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3:rc1:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3.2:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:0.72:beta1:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.6:*:*:*:*:*:*:* cpe:2.3:a:wordpress:wordpress:2.3:*:*:*:*:*:*:*

---

Published : 2008-08-27 03:21

Updated : 2017-08-08 01:32

---

NVD link : CVE-2008-3747

Mitre link : CVE-2008-3747

No products.

CWE-264