Jetpack Plugin for WordPress Security Bypass

medium Nessus Plugin ID 73686

Language:

Synopsis

The remote web server hosts a web application that is affected by a security bypass vulnerability.

Description

The WordPress Jetpack plugin installed on the remote host is affected by a security bypass vulnerability due to a flaw in the 'class.jetpack.php' script. This can allow a remote, unauthenticated attacker to submit crafted XML-RPC requests that bypass access controls, allowing the attacker to publish posts on a site.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to version 1.9.4 / 2.0.6 / 2.1.4 / 2.2.7 / 2.3.7 /2.4.4 / 2.5.2 / 2.6.3 / 2.7.2 / 2.8.2 / 2.9.3 or later.

Plugin Details

Severity: Medium

ID: 73686

File Name: wordpress_jetpack_security_bypass.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 4/23/2014

Updated: 6/5/2024

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2014-0173

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress, cpe:/a:automattic:jetpack

Required KB Items: installed_sw/WordPress, www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Patch Publication Date: 4/10/2014

Vulnerability Publication Date: 4/10/2014

Reference Information

CVE: CVE-2014-0173

BID: 66789

Detections

Analytics