Directory traversal in upgrade package uploader in WordPress - CVE-2016-7169

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU369

Directory traversal in upgrade package uploader in WordPress - CVE-2016-7169

Published: September 7, 2016 / Updated: October 18, 2018


Vulnerability identifier: #VU369
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-7169
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient sanitization of input data within the upgrade package uploader. A remote authenticated user can use directory traversal sequences to write files outside the webroot directory.

Successful exploitation of this vulnerability may lead to website compromise.


Affected software

WordPress
Arch Linux
Fedora
wordpress

How to mitigate CVE-2016-7169

Update your WordPress installation to one of the following versions:

3.7.x - 3.7.16
3.8.x - 3.8.16
3.9.x - 3.9.14
4.0.x - 4.0.13
4.1.x - 4.1.13
4.2.x - 4.2.10
4.3.x - 4.3.6
4.4.x - 4.4.5
4.5.x - 4.5.4
4.6.x - 4.6.1

WordPress - addressed in versions 3.7.16, 3.8.16, 3.9.14, 4.0.13, 4.1.13, 4.2.10, 4.3.6, 4.4.5, 4.5.4, 4.6.1
wordpress - addressed in versions 4.6.1-1.el5, 4.6.1-1.el6, 4.6.1-1.el7, 4.6.1-1.fc23, 4.6.1-1.fc24, 4.6.1-1.fc25

External References

Related Security Bulletins