Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

Remediation

References

CVE-2017-5493

Related Vulnerabilities

WordPress Plugin AccessPress Social Icons Multiple SQL Injection Vulnerabilities (1.6.6)

Oracle Database Server Other Vulnerability (CVE-2007-3856)

Envoy Proxy CVE-2024-45810 Vulnerability (CVE-2024-45810)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31144)

WordPress Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-6762)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-338 CVE-2017-5493