CVE-2017-9061
CVSS4.3
发布时间 :2017-05-18 10:29:00
修订时间 :2017-11-03 21:29:55
NMPS    

[原文]In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.


[CNNVD]CNNVD数据暂缺。


[机译]译文暂缺.

- CVSS (基础分值)

CVSS分值: 4.3 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: MEDIUM [漏洞利用存在一定的访问条件]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-79 [在Web页面生成时对输入的转义处理不恰当(跨站脚本)]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9061
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9061
(官方数据源) NVD

- 其它链接及资源

http://www.debian.org/security/2017/dsa-3870
(UNKNOWN)  DEBIAN  DSA-3870
http://www.securityfocus.com/bid/98509
(VENDOR_ADVISORY)  BID  98509
http://www.securitytracker.com/id/1038520
(UNKNOWN)  SECTRACK  1038520
https://codex.wordpress.org/Version_4.7.5
(PATCH)  CONFIRM  https://codex.wordpress.org/Version_4.7.5
https://github.com/WordPress/WordPress/commit/8c7ea71edbbffca5d9766b7bea7c7f3722ffafa6
(PATCH)  CONFIRM  https://github.com/WordPress/WordPress/commit/8c7ea71edbbffca5d9766b7bea7c7f3722ffafa6
https://wordpress.org/news/2017/05/wordpress-4-7-5/
(VENDOR_ADVISORY)  CONFIRM  https://wordpress.org/news/2017/05/wordpress-4-7-5/
https://wpvulndb.com/vulnerabilities/8819
(UNKNOWN)  MISC  https://wpvulndb.com/vulnerabilities/8819

- 漏洞信息 (F142776)

Debian Security Advisory 3870-1 (PacketStormID:F142776)
2017-06-01 00:00:00
Debian  debian.org
advisory,remote,web,vulnerability,xss,csrf
linux,debian
CVE-2017-8295,CVE-2017-9061,CVE-2017-9062,CVE-2017-9063,CVE-2017-9064,CVE-2017-9065
[点击下载]

Debian Linux Security Advisory 3870-1 - Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to force password resets, and perform various cross-site scripting and cross-site request forgery attacks.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3870-1                   security@debian.org
https://www.debian.org/security/                       Sebastien Delafond
June 01, 2017                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : wordpress
CVE ID         : CVE-2017-8295 CVE-2017-9061 CVE-2017-9062 CVE-2017-9063 
                 CVE-2017-9064 CVE-2017-9065
Debian Bug     : 862053 862816

Several vulnerabilities were discovered in wordpress, a web blogging
tool. They would allow remote attackers to force password resets, and
perform various cross-site scripting and cross-site request forgery
attacks.

For the stable distribution (jessie), these problems have been fixed in
version 4.1+dfsg-1+deb8u13.

For the upcoming stable (stretch) and unstable (sid) distributions,
these problems have been fixed in version 4.7.5+dfsg-1.

We recommend that you upgrade your wordpress packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlkvpGwACgkQEL6Jg/PV
nWQkLAgAmoAZZuY1ZY64nBpuZAA+su3YIkX0a9c0HZRv1FkPuACQhCNUjjVeLhRp
gxvq5sxOFaiv0fjT4bm07yUXDbGA0jnN5yADC9A7qLDl44c7bvm8TShAJL+W4Ju9
CccAYnJglPreCKbQajnQGCRaSRDZfouV8woT9qrYHuDYqBf1W3xaJJiAYAe2jxFm
RavqRkbbLBwAQxxNuETTvFWejf41vWW3DIGdEEWuopgz9qlINL8WUtldutQ0dGOt
+bDpfeCaS5VTvQWGKovWqioH2c10WNvVPLHMukuEjN2/xOXC2n5kchbmPSq3Pk6U
ffMwHsIlvGvvEHOXe45rOp102/JWoQ==
=bhTB
-----END PGP SIGNATURE-----
    

- 漏洞信息

WordPress Prior to 4.7.5 Multiple Security Vulnerabilities
Unknown 98509
Yes No
2017-05-16 12:00:00 2017-05-19 02:35:00
Ronni Skansing, Sam Thomas,Ben Bidner, Yorick Koster,Ronni Skansing,Weston Ruter.

- 受影响的程序版本

WordPress WordPress 4.7.4
WordPress WordPress 4.7.2
WordPress WordPress 4.7.1
WordPress WordPress 4.6.1
WordPress WordPress 4.5.2
WordPress WordPress 4.5.1
WordPress WordPress 4.5
WordPress WordPress 4.4.1
WordPress WordPress 4.4
WordPress WordPress 4.2.4
WordPress WordPress 4.2.3
WordPress WordPress 4.2.2
WordPress WordPress 4.2.1
WordPress WordPress 4.1.2
WordPress WordPress 4.1.1
WordPress WordPress 4.1
WordPress WordPress 3.9.2
WordPress WordPress 3.9.1
WordPress WordPress 3.9
WordPress WordPress 3.8.2
WordPress WordPress 3.8.1
WordPress WordPress 3.7.4
WordPress WordPress 3.7.1
WordPress WordPress 3.6.1
WordPress WordPress 3.6
WordPress WordPress 3.5.2
WordPress WordPress 3.5.1
WordPress WordPress 3.3.2
WordPress WordPress 3.2.2
WordPress WordPress 3.1.4
WordPress WordPress 3.1.3
WordPress WordPress 3.1.2
WordPress WordPress 3.1.1
WordPress WordPress 3.0.5
WordPress WordPress 3.0.4
WordPress WordPress 3.0.3
WordPress WordPress 3.0.2
WordPress WordPress 4.7.3
WordPress WordPress 4.7
WordPress WordPress 4.6
WordPress WordPress 4.5.3
WordPress WordPress 4.4.2
WordPress WordPress 4.3.1
WordPress WordPress 4.3
WordPress WordPress 4.2
WordPress WordPress 4.0.1
WordPress WordPress 4.0
WordPress WordPress 3.9.3
WordPress WordPress 3.9
WordPress WordPress 3.8.5
WordPress WordPress 3.8.4
WordPress WordPress 3.8.3
WordPress WordPress 3.8
WordPress WordPress 3.7.5
WordPress WordPress 3.7
WordPress WordPress 3.6
WordPress WordPress 3.5.0
WordPress WordPress 3.5
WordPress WordPress 3.4.2
WordPress WordPress 3.4.1
WordPress WordPress 3.4.0
WordPress WordPress 3.4
WordPress WordPress 3.3.3
WordPress WordPress 3.3.1
WordPress WordPress 3.3
WordPress WordPress 3.2.1
WordPress WordPress 3.2
WordPress WordPress 3.1
WordPress WordPress 3.0.6
WordPress WordPress 3.0.1
,WordPress WordPress 4.7.5

- 不受影响的程序版本

WordPress WordPress 4.7.5

- 漏洞讨论

WordPress is prone to the following security vulnerabilities:

1. An open-redirect vulnerability
2. Multiple security-bypass vulnerabilities
3. Multiple cross-site scripting vulnerabilities
4. A cross-site request-forgery vulnerability

An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, perform certain unauthorized actions actions, or bypass certain security restrictions.

WordPress versions 4.7.4 and prior versions are vulnerable.

- 漏洞利用

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com.

- 解决方案

Updates are available. Please see the references or vendor advisory for more information.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站