CVE-2016-4029

Опубликовано: 07 авг. 2016

Источник: nvd

CVSS3: 8.6

CVSS2: 5

EPSS Низкий

Описание

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

Комментарий

CWE-918: Server-Side Request Forgery (SSRF)

Ссылки

http://codex.wordpress.org/Version_4.5
Release Notes
http://www.debian.org/security/2016/dsa-3681
Mailing List
http://www.securitytracker.com/id/1036594
Broken Link
Third Party Advisory
VDB Entry
https://core.trac.wordpress.org/query?status=closed&milestone=4.5
Patch
https://wpvulndb.com/vulnerabilities/8473
Broken Link
http://codex.wordpress.org/Version_4.5
Release Notes
http://www.debian.org/security/2016/dsa-3681
Mailing List
http://www.securitytracker.com/id/1036594
Broken Link
Third Party Advisory
VDB Entry
https://core.trac.wordpress.org/query?status=closed&milestone=4.5
Patch
https://wpvulndb.com/vulnerabilities/8473
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Версия до 4.5 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00473

Низкий

8.6 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

CVE-2016-4029

CVSS3: 8.6

ubuntu

почти 9 лет назад

CVE-2016-4029

CVSS3: 8.6

debian

почти 9 лет назад

WordPress before 4.5 does not consider octal and hexadecimal IP addres ...

GHSA-j2rp-vprg-5m9q

CVSS3: 8.6

github

около 3 лет назад

EPSS

Процентиль: 64%

0.00473

Низкий

8.6 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-918