wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly     derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering     this string. (CVE-2017-17091)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

 - wp-includes/functions.php does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

 - wp-includes/general-template.php does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

 - wp-includes/feed.php does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injections and various Cross-Side Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks, as well as bypass some access restrictions.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2017-17091

wp-admin/user-new.php in WordPress sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

CVE-2017-17092

wp-includes/functions.php in WordPress does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

CVE-2017-17093

wp-includes/general-template.php in WordPress does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

CVE-2017-17094

wp-includes/feed.php in WordPress does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u20.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.9.1.
It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
258691	Linux Distros Unpatched Vulnerability : CVE-2017-17091	Nessus	Misc.	high
98330	WordPress 3.7.x < 3.7.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98329	WordPress 3.8.x < 3.8.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98328	WordPress 3.9.x < 3.9.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98327	WordPress 4.0.x < 4.0.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98326	WordPress 4.1.x < 4.1.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98325	WordPress 4.2.x < 4.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98324	WordPress 4.3.x < 4.3.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98323	WordPress 4.4.x < 4.4.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98322	WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98321	WordPress 4.6.x < 4.6.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98320	WordPress 4.7.x < 4.7.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98319	WordPress 4.8.x < 4.8.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
98318	WordPress 4.9.x < 4.9.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
106109	Debian DSA-4090-1 : wordpress - security update	Nessus	Debian Local Security Checks	critical
105423	Debian DLA-1216-1 : wordpress security update	Nessus	Debian Local Security Checks	high
105004	WordPress < 4.9.1 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2017-17091

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high