5

CVE-2014-5266

WordPress Core < 3.9.2 - Denial of Service via XML #2

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Mögliche Gegenmaßnahme
WordPress: Update to one of the following versions, or a newer patched version: 3.7.4, 3.8.4, 3.9.2
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version <= 3.9.1
Wordpress ≫ Wordpress Version 3.0
Wordpress ≫ Wordpress Version 3.0.1
Wordpress ≫ Wordpress Version 3.0.2
Wordpress ≫ Wordpress Version 3.0.3
Wordpress ≫ Wordpress Version 3.0.4
Wordpress ≫ Wordpress Version 3.0.5
Wordpress ≫ Wordpress Version 3.0.6
Wordpress ≫ Wordpress Version 3.1
Wordpress ≫ Wordpress Version 3.1.1
Wordpress ≫ Wordpress Version 3.1.2
Wordpress ≫ Wordpress Version 3.1.3
Wordpress ≫ Wordpress Version 3.1.4
Wordpress ≫ Wordpress Version 3.2
Wordpress ≫ Wordpress Version 3.2 Update beta1
Wordpress ≫ Wordpress Version 3.2.1
Wordpress ≫ Wordpress Version 3.3
Wordpress ≫ Wordpress Version 3.3.1
Wordpress ≫ Wordpress Version 3.3.2
Wordpress ≫ Wordpress Version 3.3.3
Wordpress ≫ Wordpress Version 3.4.0
Wordpress ≫ Wordpress Version 3.4.1
Wordpress ≫ Wordpress Version 3.4.2
Wordpress ≫ Wordpress Version 3.5.0
Wordpress ≫ Wordpress Version 3.5.1
Wordpress ≫ Wordpress Version 3.6
Wordpress ≫ Wordpress Version 3.6.1
Wordpress ≫ Wordpress Version 3.7
Wordpress ≫ Wordpress Version 3.7.1
Wordpress ≫ Wordpress Version 3.8
Wordpress ≫ Wordpress Version 3.8.1
Wordpress ≫ Wordpress Version 3.9.0
Drupal ≫ Drupal Version 6.0
Drupal ≫ Drupal Version 6.0 Update beta1
Drupal ≫ Drupal Version 6.0 Update beta2
Drupal ≫ Drupal Version 6.0 Update beta3
Drupal ≫ Drupal Version 6.0 Update beta4
Drupal ≫ Drupal Version 6.0 Update dev
Drupal ≫ Drupal Version 6.0 Update rc1
Drupal ≫ Drupal Version 6.0 Update rc2
Drupal ≫ Drupal Version 6.0 Update rc3
Drupal ≫ Drupal Version 6.0 Update rc4
Drupal ≫ Drupal Version 6.1
Drupal ≫ Drupal Version 6.2
Drupal ≫ Drupal Version 6.3
Drupal ≫ Drupal Version 6.4
Drupal ≫ Drupal Version 6.5
Drupal ≫ Drupal Version 6.6
Drupal ≫ Drupal Version 6.7
Drupal ≫ Drupal Version 6.8
Drupal ≫ Drupal Version 6.9
Drupal ≫ Drupal Version 6.10
Drupal ≫ Drupal Version 6.11
Drupal ≫ Drupal Version 6.12
Drupal ≫ Drupal Version 6.13
Drupal ≫ Drupal Version 6.14
Drupal ≫ Drupal Version 6.15
Drupal ≫ Drupal Version 6.16
Drupal ≫ Drupal Version 6.17
Drupal ≫ Drupal Version 6.18
Drupal ≫ Drupal Version 6.19
Drupal ≫ Drupal Version 6.20
Drupal ≫ Drupal Version 6.21
Drupal ≫ Drupal Version 6.22
Drupal ≫ Drupal Version 6.23
Drupal ≫ Drupal Version 6.24
Drupal ≫ Drupal Version 6.25
Drupal ≫ Drupal Version 6.26
Drupal ≫ Drupal Version 6.27
Drupal ≫ Drupal Version 6.28
Drupal ≫ Drupal Version 6.29
Drupal ≫ Drupal Version 6.30
Drupal ≫ Drupal Version 6.31
Drupal ≫ Drupal Version 6.32
Drupal ≫ Drupal Version 7.0
Drupal ≫ Drupal Version 7.0 Update alpha1
Drupal ≫ Drupal Version 7.0 Update alpha2
Drupal ≫ Drupal Version 7.0 Update alpha3
Drupal ≫ Drupal Version 7.0 Update alpha4
Drupal ≫ Drupal Version 7.0 Update alpha5
Drupal ≫ Drupal Version 7.0 Update alpha6
Drupal ≫ Drupal Version 7.0 Update alpha7
Drupal ≫ Drupal Version 7.0 Update beta1
Drupal ≫ Drupal Version 7.0 Update beta2
Drupal ≫ Drupal Version 7.0 Update beta3
Drupal ≫ Drupal Version 7.0 Update dev
Drupal ≫ Drupal Version 7.0 Update rc1
Drupal ≫ Drupal Version 7.0 Update rc2
Drupal ≫ Drupal Version 7.0 Update rc3
Drupal ≫ Drupal Version 7.0 Update rc4
Drupal ≫ Drupal Version 7.1
Drupal ≫ Drupal Version 7.2
Drupal ≫ Drupal Version 7.3
Drupal ≫ Drupal Version 7.4
Drupal ≫ Drupal Version 7.5
Drupal ≫ Drupal Version 7.6
Drupal ≫ Drupal Version 7.7
Drupal ≫ Drupal Version 7.8
Drupal ≫ Drupal Version 7.9
Drupal ≫ Drupal Version 7.10
Drupal ≫ Drupal Version 7.11
Drupal ≫ Drupal Version 7.12
Drupal ≫ Drupal Version 7.13
Drupal ≫ Drupal Version 7.14
Drupal ≫ Drupal Version 7.15
Drupal ≫ Drupal Version 7.16
Drupal ≫ Drupal Version 7.17
Drupal ≫ Drupal Version 7.18
Drupal ≫ Drupal Version 7.19
Drupal ≫ Drupal Version 7.20
Drupal ≫ Drupal Version 7.21
Drupal ≫ Drupal Version 7.22
Drupal ≫ Drupal Version 7.23
Drupal ≫ Drupal Version 7.24
Drupal ≫ Drupal Version 7.25
Drupal ≫ Drupal Version 7.26
Drupal ≫ Drupal Version 7.27
Drupal ≫ Drupal Version 7.28
Drupal ≫ Drupal Version 7.29
Drupal ≫ Drupal Version 7.30
Drupal ≫ Drupal Version 7.x-dev
Debian ≫ Debian Linux Version 7.0
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version [*, 3.7)
Version 3.7-3.7.3
Version 3.8-3.8.3
Version 3.9-3.9.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 24.39% 0.976
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.debian.org/security/2014/dsa-3001
https://wordpress.org/news/2014/08/wordpress-3-9-2/
Vendor Advisory
http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
http://www.debian.org/security/2014/dsa-2999
https://core.trac.wordpress.org/changeset/29404
https://www.drupal.org/SA-CORE-2014-004
Vendor Advisory
http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
https://www.wordfence.com/threat-intel/vulnerabilities/id/b0382227-48eb-4a97-8f3c-5c8fc4bcc0b6
Third Party Advisory