Description

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

Remediation

References

CVE-2015-5730

Related Vulnerabilities

WordPress Multiple Cross-Site Scripting Vulnerabilities (4.1 - 4.2.1)

WordPress Plugin SEO Redirection-301 Redirect Manager Multiple Cross-Site Scripting Vulnerabilities (2.8)

Magento Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-34254)

WordPress Plugin Store Locator Plus for WordPress SQL Injection (3.8.6)

PHP Other Vulnerability (CVE-2006-4433)

Severity

Medium

Classification

CVE-2015-5730 CWE-200

Tags

Missing Update Known Vulnerabilities