Multiple vulnerabilities in WordPress



Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2017-17091
CVE-2017-17093
CVE-2017-17094
CVE-2017-17092
CWE-ID CWE-330
CWE-79
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 WordPress
Web applications / CMS

Vendor WordPress.ORG

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Insufficient randomization

EUVDB-ID: #VU9453

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17091

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in wp-admin/user-new.php script due to usage of a determinate substring in newbloguser key, which can be directly derived from the user ID. A remote attacker can guess the key and bypass intended access restrictions.

Mitigation

Update to version 4.9.1.

Vulnerable software versions

WordPress: 3.7 - 4.9

CPE2.3 External links

http://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU9454

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17093

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of the language attributes used on html elements in wp-includes/general-template.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.

Mitigation

Update to version 4.9.1.

Vulnerable software versions

WordPress: 3.7 - 4.9

CPE2.3 External links

http://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU9455

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17094

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of the attributes of enclosures in RSS and Atom feeds within wp-includes/feed.php script. A remote attacker can bypass implemented filters and execute arbitrary HTML and script code in victims browser in context of the vulnerable website.

Mitigation

Update to version 4.9.1.

Vulnerable software versions

WordPress: 3.7 - 4.9

CPE2.3 External links

http://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU9456

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17092

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to upload JavaScript files.

The vulnerability exists due to incorrectly implemented access restrictions in wp-includes/functions.php script, which allowed uploading of JavaScript files for users without unfiltered_html permissions. A remote authenticated attacker can upload malicious JavaScript file and perform XSS or spoofing attacks against website users.

Mitigation

Update to version 4.9.1.

Vulnerable software versions

WordPress: 3.7 - 4.9

CPE2.3 External links

http://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###