Lucene search

[email protected]CVE-2015-5623

HistoryAug 03, 2015 - 2:59 p.m.

CVE-2015-5623

2015-08-0314:59:00

CWE-284

[email protected]

web.nvd.nist.gov

cve-2015-5623

wordpress

security vulnerability

access restriction

nvd

subscriber role

5.9 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.8%

JSON

WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

CPENameOperatorVersion
wordpress:wordpresswordpressle4.2.2
debian:debian_linuxdebian debian linuxeq8.0

CPE	Name	Operator	Version
wordpress:wordpress	wordpress	le	4.2.2
debian:debian_linux	debian debian linux	eq	8.0

References

codex.wordpress.org/Version_4.2.3

openwall.com/lists/oss-security/2015/07/23/18

www.debian.org/security/2015/dsa-3328

www.securityfocus.com/bid/76011

www.securitytracker.com/id/1033037

core.trac.wordpress.org/changeset/33357

wordpress.org/news/2015/07/wordpress-4-2-3/

wpvulndb.com/vulnerabilities/8111

5.9 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.8%

JSON

Related for CVE-2015-5623

debiancve1 patchstack1 prion1 veracode1 ubuntucve1 nessus5 wpvulndb1 checkpoint_advisories1 freebsd1 wpexploit1 cve1 mageia1 openvas5 debian2 securityvulns2 osv1 fedora2