WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 98258

Synopsis

WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

- A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An unauthenticated, remote attacker can exploit this to pass extra arguments to the sendmail binary, potentially allowing the attacker to execute arbitrary code. (CVE-2016-10033, CVE-2016-10045)

- An information disclosure vulnerability exists in the REST API implementation due to a failure to properly restrict listings of post authors. An unauthenticated, remote attacker can exploit this, via a wp-json/wp/v2/users request, to disclose sensitive information. (CVE-2017-5487)

- Multiple cross-site scripting (XSS) vulnerabilities exist in the update-core.php script due to improper validation of input to the plugin name or version header. An unauthenticated, remote attacker can exploit these, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5488)

- A cross-site request forgery (XSRF) vulnerability exists due to improper handling of uploaded Flash files. An unauthenticated, remote attacker can exploit this, via a specially crafted Flash file, to hijack the authentication of users. (CVE-2017-5489)

- A cross-site scripting (XSS) vulnerability exists in the class-wp-theme.php script due to improper validation of input when handling theme name fallback. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-5490)

- A security bypass vulnerability exists in the wp-mail.php script due to improper validation of mail server names. An unauthenticated, remote attacker can exploit this, via a spoofed mail server with the 'mail.example.com' name, to bypass intended security restrictions. (CVE-2017-5491)

- A cross-site request forgery (XSRF) vulnerability exists in the widget-editing accessibility-mode feature due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions for HTTP requests. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted URL, to hijack the authentication of users or cause them to edit widgets. (CVE-2017-5492)

- A security bypass vulnerability exists in the ms-functions.php script due to the use of weak cryptographic security for multisite activation keys. An unauthenticated, remote attacker can exploit this, via a specially crafted site sign-up or user sign-up, to bypass intended access restrictions. (CVE-2017-5493)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to WordPress version 3.9.15 or latest.

See Also

https://codex.wordpress.org/Version_3.9.15

https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

Plugin Details

Severity: Critical

ID: 98258

Type: remote

Published: 11/5/2018

Updated: 3/14/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-10033

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2016-10033

Vulnerability Information

CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/30/2016

Vulnerability Publication Date: 12/30/2016

Reference Information

CVE: CVE-2016-10033, CVE-2016-10045, CVE-2017-5487, CVE-2017-5488, CVE-2017-5489, CVE-2017-5490, CVE-2017-5491, CVE-2017-5492, CVE-2017-5493

BID: 95108, 95130, 95391, 95397, 95399, 95401, 95402, 95406, 95407

CWE: 1188, 200, 254, 310, 338, 352, 77, 79, 88

OWASP: 2010-A1, 2010-A2, 2010-A5, 2010-A6, 2013-A1, 2013-A3, 2013-A5, 2013-A8, 2013-A9, 2017-A1, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A2, 2021-A3, 2021-A6, 2021-A7

WASC: Application Misconfiguration, Brute Force, Cross-Site Request Forgery, Cross-Site Scripting, Improper Input Handling, Information Leakage, OS Commanding

CAPEC: 111, 116, 13, 136, 137, 15, 169, 174, 183, 209, 22, 224, 248, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 40, 41, 43, 460, 462, 467, 472, 485, 497, 508, 573, 574, 575, 576, 577, 588, 59, 591, 592, 60, 616, 62, 63, 643, 646, 651, 75, 76, 79, 85, 88

DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002500, APSC-DV-002510, APSC-DV-002560, APSC-DV-002630

HIPAA: 164.306(a)(1), 164.306(a)(2)

ISO: 27001-A.12.6.1, 27001-A.14.2.5, 27001-A.9.2.1, 27001-A.9.2.4, 27001-A.9.3.1, 27001-A.9.4.3

NIST: sp800_53-CM-6b, sp800_53-IA-5, sp800_53-SI-10, sp800_53-SI-10(5), sp800_53-SI-15

OWASP API: 2019-API7, 2019-API8, 2023-API8

OWASP ASVS: 4.0.2-14.2.1, 4.0.2-4.2.2, 4.0.2-5.2.5, 4.0.2-5.3.3, 4.0.2-5.3.8, 4.0.2-6.2.1, 4.0.2-8.3.4

PCI-DSS: 3.2-12.3, 3.2-2.1, 3.2-6.2, 3.2-6.5.1, 3.2-6.5.7, 3.2-6.5.8, 3.2-6.5.9, 3.2-8.1, 3.2-8.2, 3.2-8.5, 3.2-8.6