CVE-2018-6389 : In WordPress through 4.9.2, unauthenticated attackers can cause a denial of serv

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

Published 2018-02-06 17:29:00

Updated 2019-03-01 19:07:45

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2018-6389

Wordpress » Wordpress
Versions up to, including, (<=) 4.9.2
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-6389

Top countries where our scanners detected CVE-2018-6389

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-6389 48

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-6389!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-6389

EPSS FAQ

28.95%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-6389

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-6389

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-6389

https://github.com/WazeHell/CVE-2018-6389

GitHub - WazeHell/CVE-2018-6389: CVE-2018-6389 Exploit In WordPress DoS
Third Party Advisory
http://www.securityfocus.com/bid/103060

WordPress CVE-2018-6389 Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://github.com/UltimateHackers/Shiva

GitHub - s0md3v/Shiva: Improved DOS exploit for wordpress websites (CVE-2018-6389)
Exploit;Third Party Advisory
https://wpvulndb.com/vulnerabilities/9021

WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)
Third Party Advisory
https://www.exploit-db.com/exploits/43968/

WordPress Core - 'load-scripts.php' Denial of Service
Exploit;Third Party Advisory;VDB Entry
https://baraktawily.blogspot.fr/2018/02/how-to-dos-29-of-world-wide-websites.html

Information Security: How to DoS 29% of the World Wide Websites - CVE-2018-6389
Exploit;Issue Tracking;Third Party Advisory
https://thehackernews.com/2018/02/wordpress-dos-exploit.html

Unpatched DoS Flaw Could Help Anyone Take Down WordPress Websites
Exploit;Third Party Advisory
http://www.securitytracker.com/id/1040347

WordPress 'load-scripts.php' Lets Remote Users Consume Excessive I/O Resources and Deny Service - SecurityTracker
Third Party Advisory;VDB Entry