CVE-2017-5493

Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

References

https://wpvulndb.com/vulnerabilities/8721

https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4

https://codex.wordpress.org/Version_4.7.1

http://www.securitytracker.com/id/1037591

http://www.securityfocus.com/bid/95401

http://www.openwall.com/lists/oss-security/2017/01/14/6

http://www.debian.org/security/2017/dsa-3779

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3