SB2017011114 - Cross-site request forgery (CSRF) in WordPress WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017011114

SB2017011114 - Cross-site request forgery (CSRF) in WordPress WordPress

Published: January 11, 2017

Security Bulletin ID SB2017011114
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Cross-site request forgery (CSRF) (CVE-ID: CVE-2017-5492)

The vulnerability allows a remote attacker to perform CSRF attacks.

The vulnerability exists due to improper validation of the HTTP request origin within "wp-admin/includes/class-wp-screen.php" and "wp-admin/widgets.php" scripts. A remote attacker can create a specially specially crafted web page, trick the authenticated victim into visiting it, perform cross-site request forgery attack and hijack the authentication of unspecified victims for requests that perform a widgets-access action.

Successful exploitation of the vulnerability may allow an attacker to bypass authentication.




Remediation

Install update from vendor's website.

References