CVE-2017-17093
published 2017-12-02CVE-2017-17093: wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to…
PriorityP424medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
2.38%
82.1th percentile
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 4.9.1+dfsg-1 (bookworm) | wordpress 4.9.1+dfsg-1 (bookworm) |
| wordpress | wordpress | < 4.9.1 | 4.9.1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hgh7-wggh-fw3g: wp-includes/general-template
ghsa_unreviewed·2022-05-14
CVE-2017-17093 [MEDIUM] CWE-79 GHSA-hgh7-wggh-fw3g: wp-includes/general-template
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
OSV
CVE-2017-17093: wp-includes/general-template
osv·2017-12-02·CVSS 5.4
CVE-2017-17093 [MEDIUM] CVE-2017-17093: wp-includes/general-template
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Debian
CVE-2017-17093: wordpress - wp-includes/general-template.php in WordPress before 4.9.1 does not properly res...
vendor_debian·2017·CVSS 5.4
CVE-2017-17093 [MEDIUM] CVE-2017-17093: wordpress - wp-includes/general-template.php in WordPress before 4.9.1 does not properly res...
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.
Scope: local
bookworm: resolved (fixed in 4.9.1+dfsg-1)
bullseye: resolved (fixed in 4.9.1+dfsg-1)
forky: resolved (fixed in 4.9.1+dfsg-1)
sid: resolved (fixed in 4.9.1+dfsg-1)
trixie: resolved (fixed in 4.9.1+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/102024https://codex.wordpress.org/Version_4.9.1https://github.com/WordPress/WordPress/commit/3713ac5ebc90fb2011e98dfd691420f43da6c09ahttps://lists.debian.org/debian-lts-announce/2017/12/msg00019.htmlhttps://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8968https://www.debian.org/security/2018/dsa-4090http://www.securityfocus.com/bid/102024https://codex.wordpress.org/Version_4.9.1https://github.com/WordPress/WordPress/commit/3713ac5ebc90fb2011e98dfd691420f43da6c09ahttps://lists.debian.org/debian-lts-announce/2017/12/msg00019.htmlhttps://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8968https://www.debian.org/security/2018/dsa-4090
2017-12-02
Published