CVE-2017-5493: wordpress
CVSS: 7.5v3.0HighModified
AliasesUBUNTU-CVE-2017-5493DEBIAN-CVE-2017-5493
Published 15-01-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-5493 is a high (CVSS 7.5) vulnerability in wordpress. EPSS estimates a 2.89% chance of exploitation in the next 30 days, higher than 86.6% of scored vulnerabilities. Fixed in 3.7.17.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
2.89%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 15-01-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
CVSS metrics
5 scores · 4 sources · 3 versionsMedium 5.3Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.89%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.89% on 19-09-2026
19-09-202619-10-2026
EPSS score2.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wordpress2 products
- wordpress< 3.7 (fixed in 3.7.17) | ≥ 3.7, ≤ 3.7.16 (fixed in 3.7.17) | ≥ 3.8, ≤ 3.8.16 (fixed in 3.7.17) | ≥ 3.9, ≤ 3.9.14 (fixed in 3.7.17) | ≥ 4.0, ≤ 4.0.13 (fixed in 3.7.17) | ≥ 4.1, ≤ 4.1.13 (fixed in 3.7.17) | ≥ 4.2, ≤ 4.2.10 (fixed in 3.7.17) | ≥ 4.3, ≤ 4.3.6 (fixed in 3.7.17) | ≥ 4.4, ≤ 4.4.5 (fixed in 3.7.17) | ≥ 4.5, ≤ 4.5.4 (fixed in 3.7.17) | ≥ 4.6, ≤ 4.6.1 (fixed in 3.7.17) | ≥ 4.7, ≤ 4.7.0 (fixed in 3.7.17)
- wordpress≤ 4.7
Debian1 product
- wordpress< 4.7.1+dfsg-1
Ubuntu1 product
- wordpressAll versions (No fix recorded)
3 vendors · 4 products
References
13 links
- www.openwall.com/lists/oss-security/2017/01/14/6Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
- github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4X Refsource CONFIRMPatchREPORT
- wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/X Refsource CONFIRMVendor AdvisoryREPORT