CVE-2017-5493
published 2017-01-15CVE-2017-5493: wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier…
PriorityP342high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
2.79%
84.8th percentile
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 4.7.1+dfsg-1 (bookworm) | wordpress 4.7.1+dfsg-1 (bookworm) |
| wordpress | wordpress | <= 4.7 | — |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
| wordpress | wordpress | >= 0 < 4.7.1+dfsg-1 | 4.7.1+dfsg-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q3gc-45gm-v55m: wp-includes/ms-functions
ghsa_unreviewed·2022-05-13
CVE-2017-5493 [HIGH] CWE-338 GHSA-q3gc-45gm-v55m: wp-includes/ms-functions
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
OSV
CVE-2017-5493: wp-includes/ms-functions
osv·2017-01-15·CVSS 7.5
CVE-2017-5493 [HIGH] CVE-2017-5493: wp-includes/ms-functions
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Debian
CVE-2017-5493: wordpress - wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before ...
vendor_debian·2017·CVSS 7.5
CVE-2017-5493 [HIGH] CVE-2017-5493: wordpress - wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before ...
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Scope: local
bookworm: resolved (fixed in 4.7.1+dfsg-1)
bullseye: resolved (fixed in 4.7.1+dfsg-1)
forky: resolved (fixed in 4.7.1+dfsg-1)
sid: resolved (fixed in 4.7.1+dfsg-1)
trixie: resolved (fixed in 4.7.1+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.debian.org/security/2017/dsa-3779http://www.openwall.com/lists/oss-security/2017/01/14/6http://www.securityfocus.com/bid/95401http://www.securitytracker.com/id/1037591https://codex.wordpress.org/Version_4.7.1https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8721http://www.debian.org/security/2017/dsa-3779http://www.openwall.com/lists/oss-security/2017/01/14/6http://www.securityfocus.com/bid/95401http://www.securitytracker.com/id/1037591https://codex.wordpress.org/Version_4.7.1https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8721
2017-01-15
Published