CVE-2008-0193

NameCVE-2008-0193
DescriptionCross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
SourceCVE (at NVD; LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1502-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)wheezy (security), wheezy3.6.1+dfsg-1~deb7u10fixed
jessie (security), jessie4.1+dfsg-1+deb8u8fixed
stretch, sid4.5.2+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wordpresssource(unstable)2.1.0-1medium
wordpresssourceetch2.0.10-1etch1mediumDSA-1502-1

Notes

Vulnerable code removed since 2.1 release

Search for package or bug name: Reporting problems