Lucene search
HistoryAug 18, 2014 - 11:15 a.m.
CVE-2014-5266
cwe-400
xml-rpc
denial of service
wordpress
drupal
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.1 Medium
AI Score
Confidence
High
0.929 High
EPSS
Percentile
99.0%
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Affected configurations
Node
wordpresswordpressRange≤3.9.1
ORwordpresswordpressMatch3.0
ORwordpresswordpressMatch3.0.1
ORwordpresswordpressMatch3.0.2
ORwordpresswordpressMatch3.0.3
ORwordpresswordpressMatch3.0.4
ORwordpresswordpressMatch3.0.5
ORwordpresswordpressMatch3.0.6
ORwordpresswordpressMatch3.1
ORwordpresswordpressMatch3.1.1
ORwordpresswordpressMatch3.1.2
ORwordpresswordpressMatch3.1.3
ORwordpresswordpressMatch3.1.4
ORwordpresswordpressMatch3.2
ORwordpresswordpressMatch3.2beta1
ORwordpresswordpressMatch3.2.1
ORwordpresswordpressMatch3.3
ORwordpresswordpressMatch3.3.1
ORwordpresswordpressMatch3.3.2
ORwordpresswordpressMatch3.3.3
ORwordpresswordpressMatch3.4.0
ORwordpresswordpressMatch3.4.1
ORwordpresswordpressMatch3.4.2
ORwordpresswordpressMatch3.5.0
ORwordpresswordpressMatch3.5.1
ORwordpresswordpressMatch3.6
ORwordpresswordpressMatch3.6.1
ORwordpresswordpressMatch3.7
ORwordpresswordpressMatch3.7.1
ORwordpresswordpressMatch3.8
ORwordpresswordpressMatch3.8.1
ORwordpresswordpressMatch3.9.0
Node
drupaldrupalMatch6.0
ORdrupaldrupalMatch6.0beta1
ORdrupaldrupalMatch6.0beta2
ORdrupaldrupalMatch6.0beta3
ORdrupaldrupalMatch6.0beta4
ORdrupaldrupalMatch6.0dev
ORdrupaldrupalMatch6.0rc1
ORdrupaldrupalMatch6.0rc2
ORdrupaldrupalMatch6.0rc3
ORdrupaldrupalMatch6.0rc4
ORdrupaldrupalMatch6.1
ORdrupaldrupalMatch6.2
ORdrupaldrupalMatch6.3
ORdrupaldrupalMatch6.4
ORdrupaldrupalMatch6.5
ORdrupaldrupalMatch6.6
ORdrupaldrupalMatch6.7
ORdrupaldrupalMatch6.8
ORdrupaldrupalMatch6.9
ORdrupaldrupalMatch6.10
ORdrupaldrupalMatch6.11
ORdrupaldrupalMatch6.12
ORdrupaldrupalMatch6.13
ORdrupaldrupalMatch6.14
ORdrupaldrupalMatch6.15
ORdrupaldrupalMatch6.16
ORdrupaldrupalMatch6.17
ORdrupaldrupalMatch6.18
ORdrupaldrupalMatch6.19
ORdrupaldrupalMatch6.20
ORdrupaldrupalMatch6.21
ORdrupaldrupalMatch6.22
ORdrupaldrupalMatch6.23
ORdrupaldrupalMatch6.24
ORdrupaldrupalMatch6.25
ORdrupaldrupalMatch6.26
ORdrupaldrupalMatch6.27
ORdrupaldrupalMatch6.28
ORdrupaldrupalMatch6.29
ORdrupaldrupalMatch6.30
ORdrupaldrupalMatch6.31
ORdrupaldrupalMatch6.32
ORdrupaldrupalMatch7.0
ORdrupaldrupalMatch7.0alpha1
ORdrupaldrupalMatch7.0alpha2
ORdrupaldrupalMatch7.0alpha3
ORdrupaldrupalMatch7.0alpha4
ORdrupaldrupalMatch7.0alpha5
ORdrupaldrupalMatch7.0alpha6
ORdrupaldrupalMatch7.0alpha7
ORdrupaldrupalMatch7.0beta1
ORdrupaldrupalMatch7.0beta2
ORdrupaldrupalMatch7.0beta3
ORdrupaldrupalMatch7.0dev
ORdrupaldrupalMatch7.0rc1
ORdrupaldrupalMatch7.0rc2
ORdrupaldrupalMatch7.0rc3
ORdrupaldrupalMatch7.0rc4
ORdrupaldrupalMatch7.1
ORdrupaldrupalMatch7.2
ORdrupaldrupalMatch7.3
ORdrupaldrupalMatch7.4
ORdrupaldrupalMatch7.5
ORdrupaldrupalMatch7.6
ORdrupaldrupalMatch7.7
ORdrupaldrupalMatch7.8
ORdrupaldrupalMatch7.9
ORdrupaldrupalMatch7.10
ORdrupaldrupalMatch7.11
ORdrupaldrupalMatch7.12
ORdrupaldrupalMatch7.13
ORdrupaldrupalMatch7.14
ORdrupaldrupalMatch7.15
ORdrupaldrupalMatch7.16
ORdrupaldrupalMatch7.17
ORdrupaldrupalMatch7.18
ORdrupaldrupalMatch7.19
ORdrupaldrupalMatch7.20
ORdrupaldrupalMatch7.21
ORdrupaldrupalMatch7.22
ORdrupaldrupalMatch7.23
ORdrupaldrupalMatch7.24
ORdrupaldrupalMatch7.25
ORdrupaldrupalMatch7.26
ORdrupaldrupalMatch7.27
ORdrupaldrupalMatch7.28
ORdrupaldrupalMatch7.29
ORdrupaldrupalMatch7.30
ORdrupaldrupalMatch7.x-dev
Node
debiandebian_linuxMatch7.0
References
cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
www.debian.org/security/2014/dsa-2999
www.debian.org/security/2014/dsa-3001
core.trac.wordpress.org/changeset/29404
wordpress.org/news/2014/08/wordpress-3-9-2/
www.drupal.org/SA-CORE-2014-004
Related
nessus
nessus
Drupal 6.x < 6.33 / 7.x < 7.31 XML-RPC DoS
2014-08-13 00:00:00
Fedora 20 : drupal7-7.31-1.fc20 (2014-9278)
2014-08-22 00:00:00
Debian DSA-2999-1 : drupal7 - security update
2014-08-10 00:00:00
ubuntucve
ubuntucve
CVE-2014-5266
2014-08-18 00:00:00
CVE-2014-5265
2014-08-18 00:00:00
prion
prion
Design/Logic Flaw
2014-08-18 11:15:00
Design/Logic Flaw
2014-08-18 11:15:00
debiancve
debiancve
CVE-2014-5266
2014-08-18 11:15:27
CVE-2014-5265
2014-08-18 11:15:27
nvd
nvd
CVE-2014-5266
2014-08-18 11:15:27
CVE-2014-5265
2014-08-18 11:15:27
cvelist
cvelist
CVE-2014-5266
2014-08-18 10:00:00
CVE-2014-5265
2014-08-18 10:00:00
patchstack
patchstack
WordPress <= 3.9.1 - Denial Of Service Attacks #1
2014-08-15 00:00:00
WordPress <= 3.9.1 - Denial Of Service Attacks #2
2014-08-15 00:00:00
openvas
openvas
Fedora Update for drupal7 FEDORA-2014-9277
2014-08-22 00:00:00
Fedora Update for drupal7 FEDORA-2014-9278
2014-08-22 00:00:00
Debian: Security Advisory (DSA-2999-1)
2014-08-08 00:00:00
osv
osv
drupal7 - security update
2014-08-09 00:00:00
wordpress - security update
2014-09-17 00:00:00
wordpress - security update
2014-08-09 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: drupal7-7.31-1.fc19
2014-08-21 09:41:54
[SECURITY] Fedora 20 Update: drupal6-6.33-1.fc20
2014-09-26 09:05:28
[SECURITY] Fedora 20 Update: drupal7-7.31-1.fc20
2014-08-21 09:45:41
checkpoint_advisories
checkpoint_advisories
drupal
drupal
SA-CORE-2014-004 - Drupal core - Denial of service
2014-08-06 00:00:00
debian
debian
[SECURITY] [DLA 56-1] wordpress security update
2014-09-17 12:05:09
cve
cve
CVE-2014-5265
2014-08-18 11:15:27
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.1 Medium
AI Score
Confidence
High
0.929 High
EPSS
Percentile
99.0%
Related for CVE-2014-5266