What is CVE-2013-2202?

CVE-2013-2202 is a vulnerability in Wordpress, classified under Information Disclosure. Published 2013-07-08.

Is CVE-2013-2202 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Wordpress

CVE-2013-2202

WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Vulnerability class: Information Disclosure

EPSS: 0.022 (81.1th percentile) — read the EPSS interpretation.

Affected products

Wordpress — versions 0.71, 1.0, 1.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

20142995/nuclei-templates

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2013-2202?: CVE-2013-2202 is a vulnerability in Wordpress, classified under Information Disclosure. Published 2013-07-08.
Is CVE-2013-2202 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.