8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.012 Low
EPSS
Percentile
85.0%
Package : wordpress
Version : 3.6.1+dfsg-1~deb7u12
CVE ID : CVE-2015-8834 CVE-2016-4029 CVE-2016-5836
CVE-2016-6634 CVE-2016-6635 CVE-2016-7168
CVE-2016-7169
Several vulnerabilities were discovered in wordpress, a web blogging
tool. The Common Vulnerabilities and Exposures project identifies the
following issues.
CVE-2015-8834:
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in
WordPress before 4.2.2 allows remote attackers to inject arbitrary
web script or HTML via a long comment that is improperly stored
because of limitations on the MySQL TEXT data type.
NOTE: this vulnerability exists because of an incomplete fix for
CVE-2015-3440
CVE-2016-4029:
WordPress before 4.5 does not consider octal and hexadecimal IP
address formats when determining an intranet address, which allows
remote attackers to bypass an intended SSRF protection mechanism
via a crafted address.
CVE-2016-5836:
The oEmbed protocol implementation in WordPress before 4.5.3 allows
remote attackers to cause a denial of service via unspecified
vectors.
CVE-2016-6634:
Cross-site scripting (XSS) vulnerability in the network settings
page in WordPress before 4.5 allows remote attackers to inject
arbitrary web script or HTML via unspecified vectors.
CVE-2016-6635:
Cross-site request forgery (CSRF) vulnerability in the
wp_ajax_wp_compression_test function in wp-admin/includes/ajax-
actions.php in WordPress before 4.5 allows remote attackers to
hijack the authentication of administrators for requests that
change the script compression option.
CVE-2016-7168:
Fix a cross-site scripting vulnerability via image filename.
CVE-2016-7169:
Fix a path traversal vulnerability in the upgrade package uploader.
For Debian 7 "Wheezy", these problems have been fixed in version
3.6.1+dfsg-1~deb7u12.
We recommend that you upgrade your wordpress packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | all | wordpress | < 3.6.1+dfsg-1~deb7u12 | wordpress_3.6.1+dfsg-1~deb7u12_all.deb |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.012 Low
EPSS
Percentile
85.0%