WordPress 4.4.x < 4.4.10 Multiple Vulnerabilities

high Web App Scanning Plugin ID 98286

Synopsis

WordPress 4.4.x < 4.4.10 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

- A DOM-based cross-site scripting (XSS) vulnerability exists in the uploadSizeError() function within file wp-includes/js/plupload/handlers.js when handling overly large file uploads due to improper validation of user-supplied input to file names before returning it in error messages. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-9061)

- A flaw exists in the set_custom_fields() function within file wp-includes/class-wp-xmlrpc-server.php when accessing post meta data due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to gain unauthorized access to meta data. (CVE-2017-9062)

- A stored cross-site scripting (XSS) vulnerability exists within file wp-admin/customize.php script due to improper validation of user-supplied input to the blog name before returning it to users. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-9063)

- A cross-site request forgery (XSRF) vulnerability exists in the request_filesystem_credentials() function within file /wp-admin/includes/file.php due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to disclose the user credentials. (CVE-2017-9064)

- A flaw exists in the XML-RPC API, specifically within file wp-includes/class-wp-xmlrpc-server.php in the _insert_post() function, when handling post meta data due to a lack of capability checks. An unauthenticated, remote attacker can exploit this to manipulate posts without having the required capabilities. (CVE-2017-9065)

- An flaw exists in the WP_Http::request() function within file wp-includes/class-http.php due to improper validation of user-supplied iput. An unauthenticated, remote attacker can exploit this to redirect the user to a URL of the attacker's choosing. (CVE-2017-9066)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to WordPress version 4.4.10 or latest.

See Also

https://codex.wordpress.org/Version_4.4.10

https://wordpress.org/news/2017/05/wordpress-4-7-5/

Plugin Details

Severity: High

ID: 98286

Type: remote

Published: 11/5/2018

Updated: 3/14/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-9064

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2017-9064

Vulnerability Information

CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2017

Vulnerability Publication Date: 5/18/2017

Reference Information

CVE: CVE-2017-9061, CVE-2017-9062, CVE-2017-9063, CVE-2017-9064, CVE-2017-9065, CVE-2017-9066

BID: 98509

CWE: 19, 20, 352, 601, 79, 918

OWASP: 2010-A10, 2010-A2, 2010-A4, 2010-A5, 2010-A6, 2013-A10, 2013-A3, 2013-A4, 2013-A5, 2013-A8, 2013-A9, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A10, 2021-A3, 2021-A6

WASC: Application Misconfiguration, Cross-Site Request Forgery, Cross-Site Scripting, Improper Input Handling, URL Redirector Abuse

CAPEC: 10, 100, 101, 104, 108, 109, 110, 111, 120, 13, 135, 136, 14, 153, 182, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 45, 46, 462, 467, 47, 473, 52, 53, 588, 591, 592, 62, 63, 64, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9

DISA STIG: APSC-DV-002490, APSC-DV-002500, APSC-DV-002560, APSC-DV-002630, APSC-DV-003235

HIPAA: 164.306(a)(1), 164.306(a)(2)

ISO: 27001-A.12.6.1, 27001-A.14.2.5

NIST: sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-10(5)

OWASP API: 2019-API7, 2023-API7, 2023-API8

OWASP ASVS: 4.0.2-14.2.1, 4.0.2-4.2.2, 4.0.2-5.1.3, 4.0.2-5.1.5, 4.0.2-5.2.6, 4.0.2-5.3.3

PCI-DSS: 3.2-6.2, 3.2-6.5, 3.2-6.5.7, 3.2-6.5.8, 3.2-6.5.9