CVE-2017-5491 : wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass int

wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

Published 2017-01-15 02:59:03

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-5491

Wordpress » Wordpress
Versions up to, including, (<=) 4.7
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2017-5491

Top countries where our scanners detected CVE-2017-5491

Top open port discovered on systems with this issue 80

IPs affected by CVE-2017-5491 28

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2017-5491!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2017-5491

EPSS FAQ

0.56%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-5491

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2017-5491

CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-5491

https://wpvulndb.com/vulnerabilities/8719

WordPress <= 4.7 - Post via Email Checks mail.example.com by Default
https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

News – WordPress 4.7.1 Security and Maintenance Release – WordPress.org
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1037591

WordPress Bugs Let Remote Users Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks and Obtain Potentially Sensitive Information - SecurityTracker

CVEs referencing this url
http://www.securityfocus.com/bid/95406

WordPress Prior to 4.7.1 Security Bypass Vulnerability
http://www.openwall.com/lists/oss-security/2017/01/14/6

oss-security - Re: CVE Request: Wordpress: 8 security issues in 4.7
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df276fe3c8596a

Mail: Disable wp-mail.php when `mailserver_url` is mail.example.com. · WordPress/WordPress@061e878 · GitHub
Patch
http://www.debian.org/security/2017/dsa-3779

Debian -- Security Information -- DSA-3779-1 wordpress

CVEs referencing this url
https://codex.wordpress.org/Version_4.7.1

Version 4.7.1 | WordPress.org
Release Notes;Vendor Advisory

CVEs referencing this url