Vulnerability Details : CVE-2017-5610
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
Vulnerability category: Information leak
Products affected by CVE-2017-5610
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Threat overview for CVE-2017-5610
Top countries where our scanners detected CVE-2017-5610
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-5610 23
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-5610!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-5610
0.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5610
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-5610
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5610
-
https://codex.wordpress.org/Version_4.7.2
Version 4.7.2 | WordPress.orgRelease Notes;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2017/01/28/5
oss-security - Re: CVE Request: Wordpress: 4.7.2 security release: unauthorized bypass, SQL injection, cross-site scripting issuesMailing List;Patch;Third Party Advisory
-
https://github.com/WordPress/WordPress/commit/21264a31e0849e6ff793a06a17de877dd88ea454
Press This: Do not show Categories & Tags UI for users who cannot ass… · WordPress/WordPress@21264a3 · GitHubPatch;Third Party Advisory
-
https://wpvulndb.com/vulnerabilities/8729
WordPress 4.2.0-4.7.1 - Press This UI Available to Unauthorised UsersPatch;Third Party Advisory
-
http://www.securitytracker.com/id/1037731
WordPress Bugs Let Remote Users Conduct Cross-Site Scripting and SQL Injection Attacks, Obtain Potentially Sensitive Information, and Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/95816
WordPress Prior to 4.7.2 Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.debian.org/security/2017/dsa-3779
Debian -- Security Information -- DSA-3779-1 wordpressThird Party Advisory
-
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
News – WordPress 4.7.2 Security Release – WordPress.orgPatch;Vendor Advisory
Jump to