CVE-2016-4029
published 2016-08-07CVE-2016-4029: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass…
PriorityP351high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
4.57%
90.5th percentile
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 4.5+dfsg-1 (bookworm) | wordpress 4.5+dfsg-1 (bookworm) |
| wordpress | wordpress | < 4.5 | 4.5 |
| wordpress | wordpress | >= 0 < 4.5+dfsg-1 | 4.5+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.5+dfsg-1 | 4.5+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.5+dfsg-1 | 4.5+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.5+dfsg-1 | 4.5+dfsg-1 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv8.6HIGH
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j2rp-vprg-5m9q: WordPress before 4
ghsa_unreviewed·2022-05-17
CVE-2016-4029 [HIGH] CWE-285 GHSA-j2rp-vprg-5m9q: WordPress before 4
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
OSV
CVE-2016-4029: WordPress before 4
osv·2016-08-07·CVSS 8.6
CVE-2016-4029 [HIGH] CVE-2016-4029: WordPress before 4
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Debian
CVE-2016-4029: wordpress - WordPress before 4.5 does not consider octal and hexadecimal IP address formats ...
vendor_debian·2016·CVSS 8.6
CVE-2016-4029 [HIGH] CVE-2016-4029: wordpress - WordPress before 4.5 does not consider octal and hexadecimal IP address formats ...
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
Scope: local
bookworm: resolved (fixed in 4.5+dfsg-1)
bullseye: resolved (fixed in 4.5+dfsg-1)
forky: resolved (fixed in 4.5+dfsg-1)
sid: resolved (fixed in 4.5+dfsg-1)
trixie: resolved (fixed in 4.5+dfsg-1)
No detection rules found.
No public exploits indexed.
CWE
Incorrect Parsing of Numbers with Different Radices
mitre_cwe
CWE-1389 Incorrect Parsing of Numbers with Different Radices
CWE-1389: Incorrect Parsing of Numbers with Different Radices
The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
Frequently, a numeric input that begins with "0" is treated as octal, or "0x" causes it to be treated as hexadecimal, e.g. by the inet_addr() function. For example, "023" (octal) is 35 decimal, or "0x31" is 49 decimal. Other bases may be used as well. If the developer assumes decimal-only inputs, the code could produce incorrect numbers when the inputs are parsed using a different base. This can result in unexpected and/or dangerous behavior. For example, a "0127.0.0.1" IP address is parsed as octal due to the leading "0", whose numeric value would be the same as 87.0.0.1 (decimal), w
CWE
Server-Side Request Forgery (SSRF)
mitre_cwe
CWE-918 Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Application Data.
Scope: Integrity. Impact: Execute Unauthorized Code or Commands.
Scope: Access Control. Impact: Bypass Protection Mechanism. By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy
CWE
Improper Validation of Syntactic Correctness of Input
mitre_cwe
CWE-1286 Improper Validation of Syntactic Correctness of Input
CWE-1286: Improper Validation of Syntactic Correctness of Input
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Often, complex inputs are expected to follow a particular syntax, which is either assumed by the input itself, or declared within metadata such as headers. The syntax could be for data exchange formats, markup languages, or even programming languages. When untrusted input is not properly validated for the expected syntax, attackers could cause parsing failures, trigger unexpected errors, or expose latent vulnerabilities that might not be directly exploitable if the input had conformed to the syntax.
Modes of Introduction:
Phase: Imp
http://codex.wordpress.org/Version_4.5http://www.debian.org/security/2016/dsa-3681http://www.securitytracker.com/id/1036594https://core.trac.wordpress.org/query?status=closed&milestone=4.5https://wpvulndb.com/vulnerabilities/8473http://codex.wordpress.org/Version_4.5http://www.debian.org/security/2016/dsa-3681http://www.securitytracker.com/id/1036594https://core.trac.wordpress.org/query?status=closed&milestone=4.5https://wpvulndb.com/vulnerabilities/8473
2016-08-07
Published