PT-2019-5538 · WordPress · Wordpress
Publicado
2019-03-14
·
Atualizado
2020-05-06
·
CVE-2019-9787
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
WordPress versions prior to 5.1.1
Description
The issue is related to improper filtering of comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs due to mishandled CSRF protection and incorrect Search Engine Optimization of A elements, resulting in XSS. The XSS allows administrative access, enabling arbitrary changes to .php files. The
wp ajax replyto comment function in ajax-actions.php and the wp handle comment submission function in comment.php are specifically affected. Exploitation of the issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.Recommendations
For WordPress versions prior to 5.1.1, update to version 5.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the
wp ajax replyto comment function and restricting access to the wp handle comment submission function in comment.php to minimize the risk of exploitation. Additionally, restrict access to the wp-admin/includes/ajax-actions.php and wp-includes/comment.php files to prevent unauthorized changes.Exploit
Correção
RCE
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wordpress