Lucene search
GoogleOSV:CVE-2017-17091HistoryDec 02, 2017 - 6:29 a.m.
CVE-2017-17091
2017-12-0206:29:00
Google
osv.dev
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
References
www.securityfocus.com/bid/102024
codex.wordpress.org/Version_4.9.1
github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c
lists.debian.org/debian-lts-announce/2017/12/msg00019.html
wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
wpvulndb.com/vulnerabilities/8969
www.debian.org/security/2018/dsa-4090
Related
cve
cve
CVE-2017-17091
2017-12-02 06:29:00
veracode
veracode
Access Restriction Bypass
2017-12-04 02:22:46
nvd
nvd
CVE-2017-17091
2017-12-02 06:29:00
debiancve
debiancve
CVE-2017-17091
2017-12-02 06:29:00
wpvulndb
wpvulndb
WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing
2017-11-29 00:00:00
ubuntucve
ubuntucve
CVE-2017-17091
2017-12-02 00:00:00
prion
prion
Design/Logic Flaw
2017-12-02 06:29:00
cvelist
cvelist
CVE-2017-17091
2017-12-02 06:00:00
patchstack
patchstack
WordPress 3.7-4.9 - newbloguser Key Bypass
2017-11-29 00:00:00
nessus
nessus
Debian DLA-1216-1 : wordpress security update
2017-12-26 00:00:00
WordPress < 4.9.1 Multiple Vulnerabilities
2017-12-04 00:00:00
Debian DSA-4090-1 : wordpress - security update
2018-01-18 00:00:00
osv
osv
wordpress - security update
2017-12-21 00:00:00
wordpress - security update
2018-01-17 00:00:00
debian
debian
[SECURITY] [DLA 1216-1] wordpress security update
2017-12-21 20:10:37
[SECURITY] [DSA 4090-1] wordpress security update
2018-01-17 13:40:59
[SECURITY] [DSA 4090-1] wordpress security update
2018-01-17 13:40:59
openvas
openvas
Debian: Security Advisory (DLA-1216-1)
2023-03-08 00:00:00
WordPress < 4.9.1 Multiple Vulnerabilities - Linux
2017-12-04 00:00:00
WordPress < 4.9.1 Multiple Vulnerabilities - Windows
2017-12-04 00:00:00