5

CVE-2014-5266

WordPress Core < 3.9.2 - Denial of Service via XML #2

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Mögliche Gegenmaßnahme
WordPress: Update to one of the following versions, or a newer patched version: 3.7.4, 3.8.4, 3.9.2
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version <= 3.9.1
Wordpress ≫ Wordpress Version3.0
Wordpress ≫ Wordpress Version3.0.1
Wordpress ≫ Wordpress Version3.0.2
Wordpress ≫ Wordpress Version3.0.3
Wordpress ≫ Wordpress Version3.0.4
Wordpress ≫ Wordpress Version3.0.5
Wordpress ≫ Wordpress Version3.0.6
Wordpress ≫ Wordpress Version3.1
Wordpress ≫ Wordpress Version3.1.1
Wordpress ≫ Wordpress Version3.1.2
Wordpress ≫ Wordpress Version3.1.3
Wordpress ≫ Wordpress Version3.1.4
Wordpress ≫ Wordpress Version3.2
Wordpress ≫ Wordpress Version3.2 Updatebeta1
Wordpress ≫ Wordpress Version3.2.1
Wordpress ≫ Wordpress Version3.3
Wordpress ≫ Wordpress Version3.3.1
Wordpress ≫ Wordpress Version3.3.2
Wordpress ≫ Wordpress Version3.3.3
Wordpress ≫ Wordpress Version3.4.0
Wordpress ≫ Wordpress Version3.4.1
Wordpress ≫ Wordpress Version3.4.2
Wordpress ≫ Wordpress Version3.5.0
Wordpress ≫ Wordpress Version3.5.1
Wordpress ≫ Wordpress Version3.6
Wordpress ≫ Wordpress Version3.6.1
Wordpress ≫ Wordpress Version3.7
Wordpress ≫ Wordpress Version3.7.1
Wordpress ≫ Wordpress Version3.8
Wordpress ≫ Wordpress Version3.8.1
Wordpress ≫ Wordpress Version3.9.0
Drupal ≫ Drupal Version6.0
Drupal ≫ Drupal Version6.0 Updatebeta1
Drupal ≫ Drupal Version6.0 Updatebeta2
Drupal ≫ Drupal Version6.0 Updatebeta3
Drupal ≫ Drupal Version6.0 Updatebeta4
Drupal ≫ Drupal Version6.0 Updatedev
Drupal ≫ Drupal Version6.0 Updaterc1
Drupal ≫ Drupal Version6.0 Updaterc2
Drupal ≫ Drupal Version6.0 Updaterc3
Drupal ≫ Drupal Version6.0 Updaterc4
Drupal ≫ Drupal Version6.1
Drupal ≫ Drupal Version6.2
Drupal ≫ Drupal Version6.3
Drupal ≫ Drupal Version6.4
Drupal ≫ Drupal Version6.5
Drupal ≫ Drupal Version6.6
Drupal ≫ Drupal Version6.7
Drupal ≫ Drupal Version6.8
Drupal ≫ Drupal Version6.9
Drupal ≫ Drupal Version6.10
Drupal ≫ Drupal Version6.11
Drupal ≫ Drupal Version6.12
Drupal ≫ Drupal Version6.13
Drupal ≫ Drupal Version6.14
Drupal ≫ Drupal Version6.15
Drupal ≫ Drupal Version6.16
Drupal ≫ Drupal Version6.17
Drupal ≫ Drupal Version6.18
Drupal ≫ Drupal Version6.19
Drupal ≫ Drupal Version6.20
Drupal ≫ Drupal Version6.21
Drupal ≫ Drupal Version6.22
Drupal ≫ Drupal Version6.23
Drupal ≫ Drupal Version6.24
Drupal ≫ Drupal Version6.25
Drupal ≫ Drupal Version6.26
Drupal ≫ Drupal Version6.27
Drupal ≫ Drupal Version6.28
Drupal ≫ Drupal Version6.29
Drupal ≫ Drupal Version6.30
Drupal ≫ Drupal Version6.31
Drupal ≫ Drupal Version6.32
Drupal ≫ Drupal Version7.0
Drupal ≫ Drupal Version7.0 Updatealpha1
Drupal ≫ Drupal Version7.0 Updatealpha2
Drupal ≫ Drupal Version7.0 Updatealpha3
Drupal ≫ Drupal Version7.0 Updatealpha4
Drupal ≫ Drupal Version7.0 Updatealpha5
Drupal ≫ Drupal Version7.0 Updatealpha6
Drupal ≫ Drupal Version7.0 Updatealpha7
Drupal ≫ Drupal Version7.0 Updatebeta1
Drupal ≫ Drupal Version7.0 Updatebeta2
Drupal ≫ Drupal Version7.0 Updatebeta3
Drupal ≫ Drupal Version7.0 Updatedev
Drupal ≫ Drupal Version7.0 Updaterc1
Drupal ≫ Drupal Version7.0 Updaterc2
Drupal ≫ Drupal Version7.0 Updaterc3
Drupal ≫ Drupal Version7.0 Updaterc4
Drupal ≫ Drupal Version7.1
Drupal ≫ Drupal Version7.2
Drupal ≫ Drupal Version7.3
Drupal ≫ Drupal Version7.4
Drupal ≫ Drupal Version7.5
Drupal ≫ Drupal Version7.6
Drupal ≫ Drupal Version7.7
Drupal ≫ Drupal Version7.8
Drupal ≫ Drupal Version7.9
Drupal ≫ Drupal Version7.10
Drupal ≫ Drupal Version7.11
Drupal ≫ Drupal Version7.12
Drupal ≫ Drupal Version7.13
Drupal ≫ Drupal Version7.14
Drupal ≫ Drupal Version7.15
Drupal ≫ Drupal Version7.16
Drupal ≫ Drupal Version7.17
Drupal ≫ Drupal Version7.18
Drupal ≫ Drupal Version7.19
Drupal ≫ Drupal Version7.20
Drupal ≫ Drupal Version7.21
Drupal ≫ Drupal Version7.22
Drupal ≫ Drupal Version7.23
Drupal ≫ Drupal Version7.24
Drupal ≫ Drupal Version7.25
Drupal ≫ Drupal Version7.26
Drupal ≫ Drupal Version7.27
Drupal ≫ Drupal Version7.28
Drupal ≫ Drupal Version7.29
Drupal ≫ Drupal Version7.30
Drupal ≫ Drupal Version7.x-dev
Debian ≫ Debian Linux Version7.0
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version [*, 3.7)
Version 3.7-3.7.3
Version 3.8-3.8.3
Version 3.9-3.9.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 24.39% 0.976
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.debian.org/security/2014/dsa-3001
https://wordpress.org/news/2014/08/wordpress-3-9-2/
Vendor Advisory
http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
http://www.debian.org/security/2014/dsa-2999
https://core.trac.wordpress.org/changeset/29404
https://www.drupal.org/SA-CORE-2014-004
Vendor Advisory
http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
https://www.wordfence.com/threat-intel/vulnerabilities/id/b0382227-48eb-4a97-8f3c-5c8fc4bcc0b6
Third Party Advisory