CVE-2017-17092

MEDIUMNuclei

WordPress < 4.9.1 - Authenticated JavaScript File Upload

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2017-17092 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress < 4.9.1 - Authenticated JavaScript File UploadCVSS 5.4

WordPress before 4.9.1 contains a cross-site scripting caused by not requiring unfiltered_html capability for uploading .js files in functions.php, letting remote attackers execute scripts via crafted files, exploit requires upload permissions.

Impact

Remote attackers can execute arbitrary JavaScript in the context of the site, leading to potential session hijacking or defacement.

Remediation

Update to WordPress 4.9.1 or later.

WeaknessesCWE-79
Authors0x_Akoko
Template tagscvecve2017wordpresswpscanxssuploadauthenticatedintrusivefile-upload
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Shodan: http.component:"wordpress"
FOFA: body="oembed" && body="wp-"
https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ https://wpscan.com/vulnerability/0d2323bd-aecd-4d58-ba4b-597a43034f57 https://nvd.nist.gov/vuln/detail/CVE-2017-17092 https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html https://wpvulndb.com/vulnerabilities/8966

Source: ProjectDiscovery

References

8