Vulnerabilities > CVE-2016-5837 - Unspecified vulnerability in Wordpress

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
wordpress
nessus

Summary

WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Wordpress
545

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_BFCC23B63B2711E68E82002590263BF5.NASL
    descriptionAdam Silverstein reports : WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.5.2 and earlier are affected by several security issues: redirect bypass in the customizer, reported by Yassine Aboukir; two different XSS problems via attachment names, reported by Jouko Pynnonenand Divyesh Prajapati; revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; oEmbed denial of service reported by Jennifer Dodd from Automattic; unauthorized category removal from a post, reported by David Herrera from Alley Interactive; password change via stolen cookie, reported by Michael Adams from the WordPress security team; and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team.
    last seen2020-06-01
    modified2020-06-02
    plugin id91840
    published2016-06-27
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91840
    titleFreeBSD : wordpress -- multiple vulnerabilities (bfcc23b6-3b27-11e6-8e82-002590263bf5)
  • NASL familyCGI abuses
    NASL idWORDPRESS_4_5_3.NASL
    descriptionAccording to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.3. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Customizer component that allows an unauthenticated, remote attacker to perform a redirect bypass. - Multiple cross-site scripting vulnerabilities exist due to improper validation of user-supplied input when handling attachment names. An unauthenticated, remote attacker can exploit these issues, via a specially crafted request, to execute arbitrary script code in a user
    last seen2020-06-01
    modified2020-06-02
    plugin id91810
    published2016-06-24
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91810
    titleWordPress < 4.5.3 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3639.NASL
    descriptionSeveral vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions, obtain sensitive revision-history information, or mount a denial of service.
    last seen2020-06-01
    modified2020-06-02
    plugin id92706
    published2016-08-04
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92706
    titleDebian DSA-3639-1 : wordpress - security update