CVE-2018-10101 : Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localho

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Published 2018-04-16 09:58:10

Updated 2019-03-07 18:56:25

Source MITRE

View at NVD, CVE.org

Vulnerability category: Open redirect

Products affected by CVE-2018-10101

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Wordpress » Wordpress
Versions before (<) 4.9.5
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Matching versions

Top countries where our scanners detected CVE-2018-10101

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-10101 48

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-10101!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

EPSS FAQ

0.50%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Assigned by: nvd@nist.gov (Primary)

https://codex.wordpress.org/Version_4.9.5

Version 4.9.5 | WordPress.org
Vendor Advisory

CVEs referencing this url
https://core.trac.wordpress.org/changeset/42894

Changeset 42894 – WordPress Trac
Patch;Vendor Advisory
https://wpvulndb.com/vulnerabilities/9053

WordPress 3.7-4.9.4 - Remove localhost Default
Third Party Advisory
http://www.securitytracker.com/id/1040836

WordPress Bugs Let Remote Users Conduct Redirect and Cross-Site Scritping Attacks - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/

News – WordPress 4.9.5 Security and Maintenance Release – WordPress.org
Vendor Advisory

CVEs referencing this url
https://www.debian.org/security/2018/dsa-4193

Debian -- Security Information -- DSA-4193-1 wordpress
Third Party Advisory

CVEs referencing this url
https://github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216

HTTP: Don't treat `localhost` as same host by default. · WordPress/WordPress@8043638 · GitHub
Patch;Third Party Advisory
http://www.securityfocus.com/bid/104350

WordPress CVE-2018-10101 Security Vulnerability
Third Party Advisory;VDB Entry

Jump to