« Volver al listado

CVE-2011-3127

Estado: ModificadaMedia (5.8)—

WordPress v3.1 anterior a 3.1.3 y v3.2 anterior a Beta 2, no previene adecuadamente el renderizado de las páginas (1) admin o (2) login dentro de un marco en un documento HTML de terceras partes, esto facilita a los atacantes remotos realizar ataques de clickjacking a través de un sitio web manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wordpress — Wordpress

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-3127",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-08-10T21:55:02.250",
  "references": [
    {
      "url": "http://secunia.com/advisories/49138",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wordpress.org/news/2011/05/wordpress-3-1-3/",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2012/dsa-2470",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/47995",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69172",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/49138",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wordpress.org/news/2011/05/wordpress-3-1-3/",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2012/dsa-2470",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/47995",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69172",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site."
    },
    {
      "lang": "es",
      "value": "WordPress v3.1 anterior a 3.1.3 y v3.2 anterior a Beta 2, no previene adecuadamente el renderizado de las páginas (1) admin o (2) login dentro de un marco en un documento HTML de terceras partes, esto facilita a los atacantes remotos realizar ataques de clickjacking a través de un sitio web manipulado."
    }
  ],
  "lastModified": "2026-06-16T23:32:42.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88D1E83C-39AC-4E3D-874A-AF0F16ADDE41"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65FD149E-8CF4-46FE-9F5E-9DEE61B4164C"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D23F1397-7262-4B61-8061-83C2ED731DB8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:3.2:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8169A02-1AB3-4104-BA42-A934CA94B343"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}