WordPress 4.2.x < 4.2.13 Multiple Vulnerabilities

medium Web App Scanning Plugin ID 98277

Synopsis

WordPress 4.2.x < 4.2.13 Multiple Vulnerabilities

Description

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

- A cross-site scripting (XSS) vulnerability exists in the wp_playlist_shortcode() function within the /wp-includes/media.php script due to a failure to validate input passed via audio file metadata before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6814)

- A cross-site redirection vulnerability exists due to a failure to validate input passed via control characters before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted link, to redirect a user from an intended legitimate website to an arbitrary website of the attacker's choosing. (CVE-2017-6815)

- An unspecified flaw exists in the plugin deletion functionality that allows an authenticated, remote attacker to delete unintended files. (CVE-2017-6816)

- A cross-site scripting (XSS) vulnerability exists due to a failure to validate input to video URLs in YouTube embeds before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6817)

- A cross-site scripting (XSS) vulnerability exists due to a failure to validate input to taxonomy term names before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-6818)

- A cross-site request forgery (XSRF) vulnerability exists in the Press This functionality, specifically within /wp-admin/press-this.php when handling HTTP requests, due to a failure to require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted link, to cause excessive consumption of server resources. (CVE-2017-6819)

- A DOM-based cross-site scripting (XSS) vulnerability exists in the renderTracks() function within the /wp-includes/js/mediaelement/wp-playlist.min.js script due to a failure to validate input passed via audio file metadata before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to WordPress version 4.2.13 or latest.

See Also

https://codex.wordpress.org/Version_4.2.13

https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/

Plugin Details

Severity: Medium

ID: 98277

Type: remote

Published: 11/5/2018

Updated: 3/14/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2017-6815

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS Score Source: CVE-2017-6819

Vulnerability Information

CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/12/2017

Vulnerability Publication Date: 3/12/2017

Reference Information

CVE: CVE-2017-6814, CVE-2017-6815, CVE-2017-6816, CVE-2017-6817, CVE-2017-6818, CVE-2017-6819

BID: 96598, 96600, 96601, 96602

CWE: 20, 284, 352, 79, 863

OWASP: 2010-A2, 2010-A4, 2010-A5, 2010-A8, 2013-A3, 2013-A4, 2013-A7, 2013-A8, 2013-A9, 2017-A5, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6

WASC: Cross-Site Request Forgery, Cross-Site Scripting, Improper Input Handling, Insufficient Authorization

CAPEC: 10, 101, 104, 108, 109, 110, 111, 120, 13, 135, 136, 14, 153, 182, 19, 209, 22, 23, 230, 231, 24, 250, 261, 267, 28, 3, 31, 42, 43, 441, 45, 46, 462, 467, 47, 473, 478, 479, 502, 503, 52, 53, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578, 588, 591, 592, 62, 63, 64, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9

DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002500, APSC-DV-002560, APSC-DV-002630

HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)

ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5

NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-10(5)

OWASP API: 2019-API7, 2023-API8

OWASP ASVS: 4.0.2-1.4.2, 4.0.2-14.2.1, 4.0.2-4.2.2, 4.0.2-5.1.3, 4.0.2-5.3.3

PCI-DSS: 3.2-6.2, 3.2-6.5, 3.2-6.5.7, 3.2-6.5.8, 3.2-6.5.9