Vulnerability Details : CVE-2017-1000600
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
Vulnerability category: Input validationExecute code
Products affected by CVE-2017-1000600
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Threat overview for CVE-2017-1000600
Top countries where our scanners detected CVE-2017-1000600
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-1000600 31
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-1000600!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-1000600
1.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-1000600
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-1000600
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-1000600
-
https://youtu.be/GePBmsNJw6Y?t=1763
BSidesMCR 2018: It's A PHP Unserialization Vulnerability Jim, But Not As We Know It by Sam Thomas - YouTubeThird Party Advisory
-
https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/
So phar, so FUD: PHP flaw puts WordPress sites at risk of hacks • The RegisterThird Party Advisory
-
http://www.securityfocus.com/bid/105305
WordPress CVE-2017-1000600 Arbitrary File Upload VulnerabilityThird Party Advisory;VDB Entry
Jump to