CVE-2018-10101 — Open Redirect in Wordpress

CWE-601 — Open Redirect4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
9.4%
top 7.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WordpressDebian WordpressDebian Linux
Timeline
PublishedApr 16
Latest updateMay 14

Description

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 4.9.5+dfsg1-1 (bookworm)
▶NVDwordpress/wordpress< 4.9.5
▶Debianwordpress/wordpress< 4.9.5+dfsg1-1+3

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: core.trac.wordpress.org ↗Patch: github.com ↗Patch: core.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-ccmp-622j-3xf7: Before WordPress 4↗2022-05-14
▶
OSV
CVE-2018-10101: Before WordPress 4↗2018-04-16
▶

📋Vendor Advisories

1
Debian
CVE-2018-10101: wordpress - Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localho...↗2018
▶
CVE-2018-10101 — Open Redirect in Wordpress | cvebase