ID CVE-2017-9062
Summary In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
References
Vulnerable Configurations
  • cpe:2.3:a:wordpress:wordpress:4.7.4
    cpe:2.3:a:wordpress:wordpress:4.7.4
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-19
CAPEC
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • XML Nested Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By nesting XML data and causing this data to be continuously self-referential, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. An attacker's goal is to leverage parser failure to his or her advantage. In most cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it may be possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.230.1].
  • XML Oversized Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By supplying oversized payloads in input vectors that will be processed by the XML parser, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization, and potentially cause execution of arbitrary code. An attacker's goal is to leverage parser failure to his or her advantage. In many cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it is possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.231.1].
  • XML Client-Side Attack
    Client applications such as web browsers that process HTML data often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.484.1]
  • XML Parser Attack
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.99.1]
nessus via4
  • NASL family CGI abuses
    NASL id WORDPRESS_4_7_5.NASL
    description According to its self-reported version number, the WordPress application running on the remote web server is 4.7.x prior to 4.7.5. It is, therefore, affected by multiple vulnerabilities : - A DOM-based cross-site scripting (XSS) vulnerability exists in the uploadSizeError() function within file wp-includes/js/plupload/handlers.js when handling overly large file uploads due to improper validation of user-supplied input to file names before returning it in error messages. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-9061) - A flaw exists in the set_custom_fields() function within file wp-includes/class-wp-xmlrpc-server.php when accessing post meta data due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to gain unauthorized access to meta data. (CVE-2017-9062) - A stored cross-site scripting (XSS) vulnerability exists within file wp-admin/customize.php script due to improper validation of user-supplied input to the blog name before returning it to users. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-9063) - A cross-site request forgery (XSRF) vulnerability exists in the request_filesystem_credentials() function within file /wp-admin/includes/file.php due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to disclose the user credentials. (CVE-2017-9064) - A flaw exists in the XML-RPC API, specifically within file wp-includes/class-wp-xmlrpc-server.php in the _insert_post() function, when handling post meta data due to a lack of capability checks. An unauthenticated, remote attacker can exploit this to manipulate posts without having the required capabilities. (CVE-2017-9065) - A flaw exists in the WP_Http::request() function within file wp-includes/class-http.php due to improper validation of user-supplied iput. An unauthenticated, remote attacker can exploit this to redirect the user to a URL of the attacker's choosing. (CVE-2017-9066) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2018-03-10
    modified 2018-03-09
    plugin id 100298
    published 2017-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100298
    title WordPress 4.7.x < 4.7.5 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3870.NASL
    description Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to force password resets, and perform various cross-site scripting and cross-site request forgery attacks.
    last seen 2018-01-30
    modified 2018-01-29
    plugin id 100561
    published 2017-06-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100561
    title Debian DSA-3870-1 : wordpress - security update
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-975.NASL
    description Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2017-8295 Potential unauthorized password reset vulnerability. More information are available at : https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset -0day-CVE-2017-8295.html CVE-2017-9061 A cross-site scripting (XSS) vulnerability exists when someone attempts to upload very large files. CVE-2017-9062 Improper handling of post meta data values in the XML-RPC API. CVE-2017-9063 Cross-site scripting (XSS) vulnerability in the customizer. CVE-2017-9064 A Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog. CVE-2017-9065 Lack of capability checks for post meta data in the XML-RPC API. For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u15. We recommend that you upgrade your wordpress packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-01-30
    modified 2018-01-29
    plugin id 100602
    published 2017-06-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100602
    title Debian DLA-975-1 : wordpress security update
refmap via4
bid 98509
confirm
debian DSA-3870
misc https://wpvulndb.com/vulnerabilities/8816
sectrack 1038520
Last major update 18-05-2017 - 10:29
Published 18-05-2017 - 10:29
Last modified 03-11-2017 - 21:29
Back to Top