PT-2017-17350 · WordPress · Wordpress

Xuliang · Published 2017-03-12 · Updated 2019-03-19 · CVE-2017-6819

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.3

Description The issue allows for cross-site request forgery (CSRF) in Press This, leading to excessive use of server resources. This can trigger an outbound HTTP request for a large file that is then parsed by Press This.

Recommendations For versions prior to 4.7.3, update to version 4.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Press This feature until the update is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-6819

Affected Products

Wordpress

References · 16

• 🔥 http://openwall.com/lists/oss-security/2017/03/06/7 · Exploit
• 🔥 https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_function_allows_dos.html · Exploit
• https://github.com/WordPress/WordPress/commit/263831a72d08556bc2f3a328673d95301a152829 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6819 · Vendor Advisory
• https://codex.wordpress.org/Version_4.7.3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6819 · Vendor Advisory
• https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6819 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6819 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6819 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8770 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6819 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6819 · Note
• http://securitytracker.com/id/1037959 · Note