CVE-2017-1000600

EPSS 23.44%
Published 06.09.2018 12:29:00
Last modified 21.11.2024 03:04:54
Source cve@mitre.org
Teams watchlist Login
Open Login

WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Wordpress ≫ Wordpress Version < 4.9

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	23.44%	0.958

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securityfocus.com/bid/105305

Third Party Advisory

VDB Entry

https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/

Third Party Advisory

https://youtu.be/GePBmsNJw6Y?t=1763

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-1000600

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-1000600

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-1000600

EUVD