Intel

CVE-2013-0235

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning att… (CVE-2013-0235)

noneEPSS 29%

Description

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

Source: CVELISTV5NVD

Metrics

Severity
none
Priority score
58.81
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
98.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
28.9 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2013-07-08 20:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • wordpress

    wordpress3.5.0

  • wordpress

    wordpress

References & sources

IDCVE-2013-0235