Description
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 3.4.1+dfsg-1 | — |
| Debian 13 | wordpress | 3.4.1+dfsg-1 | — |
| Debian 12 | wordpress | 3.4.1+dfsg-1 | — |
References
- http://core.trac.wordpress.org/changeset?reponame=&new=21153%40branches%2F3.4&old=21076%40trunk#file16
- http://codex.wordpress.org/Version_3.4.2
- [oss-security] 20120707 Re: CVE #'s for WordPress 3.4.1 release mailing-list
- http://codex.wordpress.org/Version_3.4.1
- [oss-security] 20120912 Re: CVEs for wordpress 3.4.2 release mailing-list
- http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23
- [oss-security] 20120702 CVE #'s for WordPress 3.4.1 release mailing-list