PT-2017-16534 · WordPress · Wordpress

Chris Jean + 1 · Published 2017-01-15 · Updated 2019-10-03 · CVE-2017-5493

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.1

Description The issue concerns the Multisite WordPress API, where the wp-includes/ms-functions.php file does not properly generate random numbers for keys. This weakness allows remote attackers to bypass intended access restrictions by crafting specific site signup or user signup requests.

Recommendations For versions prior to 4.7.1, update to version 4.7.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2017-5493

DLA-813-1

DSA-3779-1

Affected Products

Wordpress

References · 31

• https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5493 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5610 · Security Note
• https://codex.wordpress.org/Version_4.7.1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5493 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5491 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5611 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5492 · Security Note
• https://security-tracker.debian.org/tracker/source-package/wordpress · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3779-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3779 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5493 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-5493 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5490 · Security Note