Launchpad.net

Launchpad Home
Code
Bugs
Blueprints
Translations
Answers

CVE 2017-14313

The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().

Related bugs and status

CVE-2017-14313 (Candidate) is related to these bugs:

Bug #1718571: [CVE] XSS security flaw due to add_query_arg

		In	Importance	Status
1718571	[CVE] XSS security flaw due to add_query_arg	wordpress-shibboleth (Ubuntu)	Medium	Fix Released
1718571	[CVE] XSS security flaw due to add_query_arg	wordpress-shibboleth (Ubuntu Zesty)	Medium	Fix Released
1718571	[CVE] XSS security flaw due to add_query_arg	wordpress-shibboleth (Ubuntu Trusty)	Medium	Fix Released
1718571	[CVE] XSS security flaw due to add_query_arg	wordpress-shibboleth (Ubuntu Artful)	Medium	Fix Released
1718571	[CVE] XSS security flaw due to add_query_arg	wordpress-shibboleth (Ubuntu Xenial)	Medium	Fix Released

See the

CVE page on Mitre.org for more details.

References

CONFIRM: https://bugs.debian.or...
CONFIRM: https://github.com/mic...
MISC: https://wpvulndb.com/v...
DEBIAN: DSA-3973