CVE-2019-9787

🗓️ 14 Mar 2019 16:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 251 Views🌐 WEB

WordPress before 5.1.1 allows Remote Code Execution by unauthenticated users due to mishandled CSRF protection and incorrect Search Engine Optimization, leading to XSS and administrative access

Reporter	Title	Published	Views	Family All 62
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Wordpress	19 May 202022:09	–	githubexploit
GithubExploit	Exploit for Path Traversal in Wordpress	18 Aug 201904:50	–	githubexploit
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Wordpress	29 Jun 202108:57	–	githubexploit
CNVD	WordPress Cross-Site Request Forgery Vulnerability (CNVD-2020-28775)	15 Mar 201900:00	–	cnvd
Check Point Advisories	WordPress Core Remote Code Execution (CVE-2019-9787)	20 Nov 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-9787	14 Mar 201916:00	–	cvelist
Debian	[SECURITY] [DLA 1742-1] wordpress security update	31 Mar 201919:30	–	debian
Debian	[SECURITY] [DSA 4677-1] wordpress security update	6 May 202006:30	–	debian
Debian	[SECURITY] [DSA 4677-1] wordpress security update	6 May 202006:30	–	debian
Debian CVE	CVE-2019-9787	14 Mar 201916:00	–	debiancve

NVD

Node

wordpress wordpressRange<5.1.1

Source	Link
blog	www.blog.ripstech.com/2019/wordpress-csrf-to-rce/
wordpress	www.wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/
lists	www.lists.debian.org/debian-lts-announce/2019/03/msg00044.html
securityfocus	www.securityfocus.com/bid/107411
debian	www.debian.org/security/2020/dsa-4677
wordpress	www.wordpress.org/support/wordpress-version/version-5-1-1/
github	www.github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b
wpvulndb	www.wpvulndb.com/vulnerabilities/9230

Parameter	Position	Path	Description	CWE
comment	request body	/wp-comments-post.php	CVE-2019-9787 CSRF/XSS leads to unauthorized actions via WordPress comments processing.	CWE-352
comment_post_ID	request body	/wp-comments-post.php	CVE-2019-9787 CSRF/XSS leads to unauthorized actions via WordPress comments processing.	CWE-352
comment_parent	request body	/wp-comments-post.php	CVE-2019-9787 CSRF/XSS leads to unauthorized actions via WordPress comments processing.	CWE-352

21 Nov 2024 04:52Current

8.5High risk

Vulners AI Score8.5

CVSS 26.8

CVSS 38.8

EPSS0.81017

CWE-352