Vulnerabilities > CVE-2016-5838 - Credentials Management vulnerability in Wordpress
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_BFCC23B63B2711E68E82002590263BF5.NASL description Adam Silverstein reports : WordPress 4.5.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.5.2 and earlier are affected by several security issues: redirect bypass in the customizer, reported by Yassine Aboukir; two different XSS problems via attachment names, reported by Jouko Pynnonenand Divyesh Prajapati; revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; oEmbed denial of service reported by Jennifer Dodd from Automattic; unauthorized category removal from a post, reported by David Herrera from Alley Interactive; password change via stolen cookie, reported by Michael Adams from the WordPress security team; and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team. last seen 2020-06-01 modified 2020-06-02 plugin id 91840 published 2016-06-27 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91840 title FreeBSD : wordpress -- multiple vulnerabilities (bfcc23b6-3b27-11e6-8e82-002590263bf5) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-568.NASL description Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-5387 WordPress allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. CVE-2016-5832 The customizer in WordPress allows remote attackers to bypass intended redirection restrictions via unspecified vectors. CVE-2016-5834 Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post- template.php in WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name. CVE-2016-5835 WordPress allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php. CVE-2016-5838 WordPress allows remote attackers to bypass intended password- change restrictions by leveraging knowledge of a cookie. CVE-2016-5839 WordPress allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. For Debian 7 last seen 2020-03-17 modified 2016-08-01 plugin id 92632 published 2016-08-01 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/92632 title Debian DLA-568-1 : wordpress security update (httpoxy) NASL family CGI abuses NASL id WORDPRESS_4_5_3.NASL description According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.3. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Customizer component that allows an unauthenticated, remote attacker to perform a redirect bypass. - Multiple cross-site scripting vulnerabilities exist due to improper validation of user-supplied input when handling attachment names. An unauthenticated, remote attacker can exploit these issues, via a specially crafted request, to execute arbitrary script code in a user last seen 2020-06-01 modified 2020-06-02 plugin id 91810 published 2016-06-24 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91810 title WordPress < 4.5.3 Multiple Vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3639.NASL description Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions, obtain sensitive revision-history information, or mount a denial of service. last seen 2020-06-01 modified 2020-06-02 plugin id 92706 published 2016-08-04 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/92706 title Debian DSA-3639-1 : wordpress - security update
References
- http://www.debian.org/security/2016/dsa-3639
- http://www.debian.org/security/2016/dsa-3639
- http://www.securityfocus.com/bid/91367
- http://www.securityfocus.com/bid/91367
- http://www.securitytracker.com/id/1036163
- http://www.securitytracker.com/id/1036163
- https://codex.wordpress.org/Version_4.5.3
- https://codex.wordpress.org/Version_4.5.3
- https://wordpress.org/news/2016/06/wordpress-4-5-3/
- https://wordpress.org/news/2016/06/wordpress-4-5-3/
- https://wpvulndb.com/vulnerabilities/8524
- https://wpvulndb.com/vulnerabilities/8524