PT-2017-18265 · WordPress · Wordpress

Dawid Golunski · Published 2017-05-04 · Updated 2023-01-02 · CVE-2017-8295

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.5

Description The issue allows remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request. This is related to problematic use of the SERVER NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period, (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.

Recommendations For WordPress versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-login.php page to minimize the risk of exploitation. Additionally, users can restrict the use of the wp-login.php?action=lostpassword endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2017-8295

DLA-975-1

DSA-3870-1

Affected Products

Wordpress

References · 29

• 🔥 https://github.com/cyberheartmi9/CVE-2017-8295 · Exploit
• 🔥 https://exploit-db.com/exploits/41963 · Exploit
• 🔥 https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html · Exploit
• https://osv.dev/vulnerability/DSA-3870-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9062 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8295 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8295 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9061 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9063 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8295 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8295 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/wordpress · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8295 · Security Note
• https://ubuntu.com/security/CVE-2017-8295 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8295 · Vendor Advisory