Vulnerability Details : CVE-2017-17091
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
Exploit prediction scoring system (EPSS) score for CVE-2017-17091
Probability of exploitation activity in the next 30 days: 0.38%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 69 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-17091
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
[email protected] |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
[email protected] |
CWE ids for CVE-2017-17091
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: [email protected] (Primary)
References for CVE-2017-17091
-
http://www.securityfocus.com/bid/102024
Third Party Advisory;VDB Entry
- https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html
- https://www.debian.org/security/2018/dsa-4090
-
https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
Release Notes
-
https://wpvulndb.com/vulnerabilities/8969
Third Party Advisory;VDB Entry
-
https://github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c
Patch
-
https://codex.wordpress.org/Version_4.9.1
Release Notes;Patch
Products affected by CVE-2017-17091
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*