The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

Two vulnerabilities were discovered in wordpress, a web blogging tool.
The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2016-5836

The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

CVE-2018-12895

A vulnerability was discovered in Wordpress, a web blogging tool. It allowed remote attackers with specific roles to execute arbitrary code.

For Debian 8 'Jessie', these problems have been fixed in version 4.1+dfsg-1+deb8u18.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2015-8834: Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440

CVE-2016-4029: WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

CVE-2016-5836: The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

CVE-2016-6634: Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2016-6635: Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax- actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

CVE-2016-7168: Fix a cross-site scripting vulnerability via image filename.

CVE-2016-7169: Fix a path traversal vulnerability in the upgrade package uploader.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.1+dfsg-1~deb7u12.

We recommend that you upgrade your wordpress packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of WordPress prior to 4.5.3 are affected by multiple vulnerabilities :

 - A flaw exists in Customizer, which may allow an attacker to perform a "redirect bypass".
 - Multiple cross-site scripting (XSS) attacks exist because the program does not validate input when handling attachment names before returing it to users. This allows a remote attacker to craft a request that can execute arbitrary script in a user's browser session withing the trust relationship between their browser and the server.
 - A flaw in the program may allow an attacker to gain access to potentially sensitive information in the revision history. No further details have been provided by the vendor.
 - A flaw exists in oEmbed, which may allow a remote attacker to cause a denial of service. No further details have been provided by the vendor.
 - The program contains a flaw which may allow an unauthorized attacker to remove categories from posts. No further details have been provided by the vendor.
 - A flaw is triggered when handling stolen cookies. This may allow a remote attacker to make changes to passwords. No further details have been provided by the vendor.
 - Multiple flaws exist related to 'sanitize_file_name()', which may allow an attacker to have an unspecified impact. No further details have been provided by the vendor.

Adam Silverstein reports :

WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.2 and earlier are affected by several security issues: redirect bypass in the customizer, reported by Yassine Aboukir; two different XSS problems via attachment names, reported by Jouko Pynnonenand Divyesh Prajapati; revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; oEmbed denial of service reported by Jennifer Dodd from Automattic; unauthorized category removal from a post, reported by David Herrera from Alley Interactive; password change via stolen cookie, reported by Michael Adams from the WordPress security team;
and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.3.
It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists in the Customizer component     that allows an unauthenticated, remote attacker to     perform a redirect bypass.

  - Multiple cross-site scripting vulnerabilities exist due     to improper validation of user-supplied input when     handling attachment names. An unauthenticated, remote     attacker can exploit these issues, via a specially     crafted request, to execute arbitrary script code in a     user's browser session.

  - An information disclosure vulnerability exists that     allows an unauthenticated, remote attacker to disclose     revision history.

  - An unspecified flaw exists in oEmbed that allows an     unauthenticated, remote attacker to cause a denial of     service condition.

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to remove categories     from posts.

  - An unspecified flaw exists that is triggered when     handling stolen cookies. An unauthenticated, remote     attacker can exploit this to change user passwords.

  - Multiple unspecified flaws exist in the     sanitize_file_name() function that allow an     unauthenticated, remote attacker to have an unspecified     impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
111393	Debian DLA-1452-1 : wordpress security update	Nessus	Debian Local Security Checks	high
93667	Debian DLA-633-1 : wordpress security update	Nessus	Debian Local Security Checks	high
9388	WordPress < 4.5.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
91840	FreeBSD : wordpress -- multiple vulnerabilities (bfcc23b6-3b27-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
91810	WordPress < 4.5.3 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2016-5836

high

Tenable Plugins

high

high

medium

high

high