CVE-2017-17094
published 2017-12-02CVE-2017-17094: wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks…
PriorityP426medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
2.38%
82.0th percentile
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wordpress | < wordpress 4.9.1+dfsg-1 (bookworm) | wordpress 4.9.1+dfsg-1 (bookworm) |
| wordpress | wordpress | < 4.9.1 | 4.9.1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.9.1+dfsg-1 | 4.9.1+dfsg-1 |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2017-17094: wordpress - wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclos...
vendor_debian·2017·CVSS 5.4
CVE-2017-17094 [MEDIUM] CVE-2017-17094: wordpress - wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclos...
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
Scope: local
bookworm: resolved (fixed in 4.9.1+dfsg-1)
bullseye: resolved (fixed in 4.9.1+dfsg-1)
forky: resolved (fixed in 4.9.1+dfsg-1)
sid: resolved (fixed in 4.9.1+dfsg-1)
trixie: resolved (fixed in 4.9.1+dfsg-1)
GHSA
GHSA-2h28-99xh-9cvg: wp-includes/feed
ghsa_unreviewed·2022-05-14
CVE-2017-17094 [MEDIUM] CWE-79 GHSA-2h28-99xh-9cvg: wp-includes/feed
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
OSV
CVE-2017-17094: wp-includes/feed
osv·2017-12-02·CVSS 5.4
CVE-2017-17094 [MEDIUM] CVE-2017-17094: wp-includes/feed
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/102024https://codex.wordpress.org/Version_4.9.1https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f90541dehttps://lists.debian.org/debian-lts-announce/2017/12/msg00019.htmlhttps://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8967https://www.debian.org/security/2018/dsa-4090http://www.securityfocus.com/bid/102024https://codex.wordpress.org/Version_4.9.1https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f90541dehttps://lists.debian.org/debian-lts-announce/2017/12/msg00019.htmlhttps://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8967https://www.debian.org/security/2018/dsa-4090
2017-12-02
Published