CVE-2016-6897
published 2017-01-18CVE-2016-6897: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows…
PriorityP351medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EXPLOIT
EPSS
28.26%
97.9th percentile
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 4.6.1+dfsg-1 (bookworm) | wordpress 4.6.1+dfsg-1 (bookworm) |
| wordpress | wordpress | <= 4.5.5 | — |
| wordpress | wordpress | >= 0 < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.6.1+dfsg-1 | 4.6.1+dfsg-1 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv7.1HIGH
vendor_debian7.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2016-6897: wordpress - Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin fun...
vendor_debian·2016·CVSS 7.1
CVE-2016-6897 [HIGH] CVE-2016-6897: wordpress - Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin fun...
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Scope: local
bookworm: resolved (fixed in 4.6.1+dfsg-1)
bullseye: resolved (fixed in 4.6.1+dfsg-1)
forky: resolved (fixed in 4.6.1+dfsg-1)
sid: resolved (fixed in 4.6.1+dfsg-1)
trixie: resolved (fixed in 4.6.1+dfsg-1)
GHSA
GHSA-rxch-vxwr-47jw: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions
ghsa_unreviewed·2022-05-17·CVSS 7.1
CVE-2016-6897 [HIGH] CWE-352 GHSA-rxch-vxwr-47jw: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
OSV
CVE-2016-6897: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions
osv·2017-01-18·CVSS 7.1
CVE-2016-6897 [HIGH] CVE-2016-6897: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
No detection rules found.
Exploit-DB
WordPress Core 4.5.3 - Directory Traversal / Denial of Service
exploitdb·2016-08-22·CVSS 7.1
CVE-2016-6897 [HIGH] WordPress Core 4.5.3 - Directory Traversal / Denial of Service
WordPress Core 4.5.3 - Directory Traversal / Denial of Service
---
Path traversal vulnerability in WordPress Core Ajax handlers
Abstract
A path traversal vulnerability was found in the Core Ajax handlers of the WordPress Admin API. This issue can (potentially) be used by an authenticated user (Subscriber) to create a denial of service condition of an affected WordPress site.
Contact
For feedback or questions about this advisory mail us at sumofpwn at securify.nl
The Summer of Pwnage
This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securi
Metasploit
WordPress Traversal Directory DoS
metasploit·CVSS 7.1
CVE-2016-6896 [HIGH] WordPress Traversal Directory DoS
WordPress Traversal Directory DoS
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Bugzilla
Path Traversal Vulnerability in Mozilla WP-Engine Wordpress 4.5.3
bugzilla·2016-09-08
[MEDIUM] Path Traversal Vulnerability in Mozilla WP-Engine Wordpress 4.5.3
Path Traversal Vulnerability in Mozilla WP-Engine Wordpress 4.5.3
Path Traversal Vulnerability in Mozilla blog
affected URL : https://blog.mozilla.org
CMS : wordpress
Version 4.5.3
A path traversal vulnerability was found in the Core Ajax handlers of the WordPress 4.5.3 Admin API. and https://blog.mozilla.org is using the same version so its affected with the vulnerability, This issue can (potentially) be used by an authenticated user (Subscriber) to create a denial of service condition of an affected website.
The path traversal vulnerability exists in the file ajax-actions.php, in particular in the function wp_ajax_update_plugin()
As can be seen in the attached screenshot, the function first tries to retrieve some version information from the target plugin. After this is done, it chec
Bugzilla
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6
bugzilla·2016-08-22·CVSS 7.1
CVE-2016-6896 [HIGH] CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6
A path traversal vulnerability was found in the Core Ajax handlers of
the WordPress Admin API. This issue can (potentially) be used by an
authenticated user (Subscriber) to create a denial of service condition
of an affected WordPress site.
It is also possible to trigger this issue via Cross-Site Request Forgery
as the nonce check is done too late in this case.
References:
http://seclists.org/oss-sec/2016/q3/341
External References:
https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html
Discussion:
Created wordpress tracking bugs for this issue:
Affects: fedora-all [bug 1369120]
Affects: epel-all [bug 1369121]
---
wordpress-4.6-2.fc25 has been pushe
Bugzilla
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [fedora-all]
bugzilla·2016-08-22·CVSS 7.1
CVE-2016-6896 [HIGH] CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [fedora-all]
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [epel-all]
bugzilla·2016-08-22·CVSS 7.1
CVE-2016-6896 [HIGH] CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [epel-all]
CVE-2016-6896 CVE-2016-6897 wordpress: Multiple vulnerabilities fixed in wordpress 4.6 [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multip
http://www.openwall.com/lists/oss-security/2016/08/20/1http://www.securityfocus.com/bid/92572http://www.securitytracker.com/id/1036683https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.htmlhttps://wpvulndb.com/vulnerabilities/8606https://www.exploit-db.com/exploits/40288/http://www.openwall.com/lists/oss-security/2016/08/20/1http://www.securityfocus.com/bid/92572http://www.securitytracker.com/id/1036683https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.htmlhttps://wpvulndb.com/vulnerabilities/8606https://www.exploit-db.com/exploits/40288/
2017-01-18
Published