Re: WordPress 3.9.2 release - needs CVE's

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> >  > XSS: https://core.trac.wordpress.org/changeset/29398
> >
> > We think this can have a CVE ID only if it allows privilege escalation
> > from Administrator to Super Admin in a Multisite installation. Does
> > it? (On other installations, Administrator has the unfiltered_html
> > capability.)
>
> Yes.

Use CVE-2014-5240.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJT7EsgAAoJEKllVAevmvms+hoH/ilXPjm0IpKxiCloifcRPBk2
QnYSIOiCf3YkTjJ338M8+eCVFOvyZ5l0AUzTkGbVPlT9umDQPyQremAc9+zQnc30
d6OCfEmUdxodhh88Ir55YsxUtw00iZBFYZvDzTmdQJpGElqQmaff1o4R63ANTU/+
RbEEGsbrEjhhDw7lwTGuaXj2s24rMG4YgBd+Ny2aUhFCrj54gQlMlM1uhtKXdmJp
FuBwPJIu8ZmZJA1Lt9eglJ4mn+LJMaVaVLU2JXAihznyNiZuB5W95ZTF8NQjKBJa
+2olT6n/NhlQL9ud4qTxZbEI9zNu8zgANBWRQVhW/LM21tPuPUyb4/AKJmbyiRw=
=YagB
-----END PGP SIGNATURE-----