CVE-2014-5266
NoneCVSS
—
EPSS
25.2%
Published
Aug 18, 2014
CISA due date
—
The record
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | wordpress | 0 | 3.9.2+dfsg-1 |
| Debian:12 | wordpress | 0 | 3.9.2+dfsg-1 |
| Debian:13 | wordpress | 0 | 3.9.2+dfsg-1 |
| Debian:6.0 | wordpress | 0 | 3.6.1+dfsg-1~deb6u5 |
| Debian:7 | drupal7 | 0 | 7.14-2+deb7u6 |
| Debian:7 | wordpress | 0 | 3.6.1+dfsg-1~deb7u4 |
| Ubuntu:14.04:LTS | wordpress | 0 | 3.8.2+dfsg-1ubuntu0.1 |
| Ubuntu:Pro:14.04:LTS | drupal7 | 0 | No fix |
Related vulnerabilities
- CVE-2022-4973 WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site… Also affects wordpress
- CVE-2024-31111 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site… Also affects wordpress
- CVE-2024-6307 WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various… Also affects wordpress
- CVE-2024-4439 WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the… Also affects wordpress
- CVE-2023-5692 WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and… Also affects wordpress
- CVE-2024-31210 WordPress is an open publishing platform for the Web. Also affects wordpress
- CVE-2023-2745 WordPress Core is vulnerable to Directory Traversal in versions up to, and including… Also affects wordpress
- CVE-2017-14719 Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during… Also affects wordpress