CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-6815 – WordPress Core < 4.7.3 - Bypass URL Validation
https://notcve.org/view.php?id=CVE-2017-6815
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. En WordPress en versiones anteriores a 4.7.3 (wp-includes/pluggable.php), los caracteres de control pueden trucar la validación de la URL de direccionamiento. • http://www.debian.org/security/2017/dsa-3815 http://www.securityfocus.com/bid/96600 http://www.securitytracker.com/id/1037959 https://codex.wordpress.org/Version_4.7.3 https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb589cea51ce40e https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/8766 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 45%CPEs: 3EXPL: 0CVE-2017-1001000 – WordPress Core < 4.7.2 - Arbitrary Page Modification
https://notcve.org/view.php?id=CVE-2017-1001000
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI. La función register_routes en wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php en la API REST en WordPress 4.7.x en versiones anteriores a 4.7.2 no requiere un identificador de número entero, lo que permite a atacantes remotos modificar páginas arbitrarias a través de una solicitud para wp-json/wp/v2/posts seguida por un valor numérico y un valor no numérico, según lo demostrado mediante la URI wp-json/wp/v2/posts/123?id=123helloworld. • http://www.openwall.com/lists/oss-security/2017/02/10/16 http://www.securitytracker.com/id/1037731 https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html https://blogs.akamai.com/2017/02/wordpress-web-api-vulnerability.html https://codex.wordpress.org/Version_4.7.2 https://gist.github.com/leonjza/2244eb15510a0687ed93160c623762ab https://github.com/WordPress/WordPress/commit/e357195ce303017d517aff944644a7a1232926f7 https://make.wordpress.org/core/2017/02/01/disclosure-of • CWE-285: Improper Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6514 – WordPress Core < 4.7.2 - Path Disclosure
https://notcve.org/view.php?id=CVE-2017-6514
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring. WordPress 4.7.2 maneja de manera inapropiada los listados de los autores de las publicaciones, esto permite a los atacantes remotos obtener información confidencial (Path Disclosure) mediante un /wp-json/oembed/1.0/embed?url= request, relacionada con la subcadena "author_name": ". • http://www.securityfocus.com/bid/108459 https://github.com/CFSECURITE/wordpress https://web.archive.org/web/20180612235401/https://github.com/CFSECURITE/wordpress • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6707 – WordPress Core - Informational - All known Versions - Weak Hashing Algorithm
https://notcve.org/view.php?id=CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions. WordPress hasta la versión 4.8.2 emplea un algoritmo débil de hash de contraseñas basado en MD5, lo que facilita que atacantes determinen valores en texto claro aprovechando el acceso a los valores hash. NOTA: la forma de cambiar esto puede no ser totalmente compatible con ciertos casos de uso, como la migración de un sitio de WordPress desde un host web que emplee una versión reciente de PHP a un host web diferente que emplee PHP 5.2. • https://core.trac.wordpress.org/ticket/21022 • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •