Description

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

Remediation

References

CVE-2017-5493

Related Vulnerabilities

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.10)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-10401)

TYPO3 Uncontrolled Recursion Vulnerability (CVE-2022-23500)

WordPress Plugin Activity Log Multiple Cross-Site Scripting Vulnerabilities (2.4.0)

PrestaShop Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2022-21686)

Severity

High

Classification

CVE-2017-5493 CWE-338 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities