PT-2017-16534 · WordPress · Wordpress

Chris Jean + 1 · Publicado 2017-01-15 · Atualizado 2019-10-03 · CVE-2017-5493

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.1

Description The issue concerns the Multisite WordPress API, where the wp-includes/ms-functions.php file does not properly generate random numbers for keys. This weakness allows remote attackers to bypass intended access restrictions by crafting specific site signup or user signup requests.

Recommendations For versions prior to 4.7.1, update to version 4.7.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2017-5493

DLA-813-1

DSA-3779-1

Produtos afetados

Wordpress

Referências · 31

• https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5493 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5493 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5610 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/8721 · Nota
• https://codex.wordpress.org/Version_4.7.1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5493 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5491 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5611 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5493 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5492 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/wordpress · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3779-1 · Aviso do Fabricante
• http://debian.org/security/2017/dsa-3779 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/01/14/1 · Nota