Vulnerability CVE-2018-10101


Published: 2018-04-16

Description:
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Type:

CWE-601

(URL Redirection to Untrusted Site ('Open Redirect'))

Vendor: Debian
Product: Debian linux 
Version: 9.0; 8.0;
Vendor: Wordpress
Product: Wordpress 
Version:
4.8.1
4.8
4.7.5
4.7.3
4.7.2
4.7.1
4.7
4.5.5
4.5.3
4.5.2
4.5.1
4.4.4
4.4.2
4.4.1
4.4.0
4.3.0
4.2.3
4.2.2
4.2.1
4.2
4.1.1
4.1
4.0.1
4.0
3.9.3
3.9.2
3.9.1
3.9.0
3.9
3.8.4
3.8.3
3.8.2
3.8.1
3.8
3.7.5
3.7.4
3.7.1
3.7
3.6.1
3.6
3.5.1
3.5.0
3.4.2
3.4.1
3.4.0
3.3.3
3.3.2
3.3.1
3.3
3.2.1
3.2
3.1.4
3.1.3
3.1.2
3.1.1
3.1
3.0.6
3.0.5
3.0.4
3.0.3
3.0.2
3.0.1
3.0
2.9.2
2.9.1.1
2.9.1
2.9
2.8.6
2.8.5.2
2.8.5.1
2.8.5
2.8.4
2.8.3
2.8.2
2.8.1
2.8
2.7.1
2.7
2.6.5
2.6.3
2.6.2
2.6.1
2.6
2.5.1
2.5
2.3.3
2.3.2
2.3.1
2.3
2.2.3
2.2.2
2.2.1
2.2
2.1.3
2.1.2
2.1.1
2.1
2.0.9
See more versions on NVD

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None

 References:
http://www.securityfocus.com/bid/104350
http://www.securitytracker.com/id/1040836
https://codex.wordpress.org/Version_4.9.5
https://core.trac.wordpress.org/changeset/42894
https://github.com/WordPress/WordPress/commit/804363859602d4050d9a38a21f5a65d9aec18216
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
https://wpvulndb.com/vulnerabilities/9053
https://www.debian.org/security/2018/dsa-4193

Related CVE
CVE-2018-20153
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
CVE-2018-20152
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
CVE-2018-20151
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the p...
CVE-2018-20150
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
CVE-2018-20149
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
CVE-2018-20148
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_t...
CVE-2018-20147
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
CVE-2018-1000773
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail u...

Copyright 2019, cxsecurity.com

 

Back to Top