CVEvulnerability
CVE-2017-5493
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-338
Description
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Affected configurations
• wordpress wordpress (<= 4.7)
Related
Weakness · CWE (1)
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness
References
- http://www.debian.org/security/2017/dsa-3779 www.debian.org
- http://www.openwall.com/lists/oss-security/2017/01/14/6 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/95401 www.securityfocus.com
- http://www.securitytracker.com/id/1037591 www.securitytracker.com
- https://codex.wordpress.org/Version_4.7.1 Release Notes, Vendor Advisory
- https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 Patch
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Vendor Advisory
- https://wpvulndb.com/vulnerabilities/8721 wpvulndb.com
- http://www.debian.org/security/2017/dsa-3779 www.debian.org
- http://www.openwall.com/lists/oss-security/2017/01/14/6 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/95401 www.securityfocus.com
- http://www.securitytracker.com/id/1037591 www.securitytracker.com
- https://codex.wordpress.org/Version_4.7.1 Release Notes, Vendor Advisory
- https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4 Patch
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ Vendor Advisory
- https://wpvulndb.com/vulnerabilities/8721 wpvulndb.com