CERT-In Vulnerability Note
CIVN-2018-0220
Multiple Vulnerabilities in WordPress
Original Issue Date:December 21, 2018
Severity Rating: HIGH
Software Affected
- WordPress versions 5.0 and prior
Overview
Multiple vulnerabilities have been reported in WordPress which could be exploited by an attacker to bypass security restrictions, conduct cross site scripting attacks, obtain sensitive information, or execute arbitrary code on the targeted system.
Description
1. WordPress File Deletion Restriction Bypass Vulnerability
(
CVE-2018-20147
)
This vulnerability exists in Word Press due to improper handling of security restrictions by the affected software. A remote attacker could exploit this vulnerability by maliciously modifying metadata on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to bypass security restrictions to delete files on a targeted system.
2. WordPress PHP Object Injection Vulnerability
(
CVE-2018-20148
)
This vulnerability exists in wp_get_attachment_thumb_file function in the in the wp_includes/post.php source code file of Word Press due its failure to handle serialized data. A local attacker could exploit this vulnerability by submitting crafted metadata to the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary PHP code on the targeted system.
3. WordPress User-Activation Page Information Disclosure Vulnerability
(
CVE-2018-20151
)
This vulnerability exists in Word Press due to allowing of the user-activation page to be read by search engine web crawlers of the affected software. A remote attacker could exploit this vulnerability by using a crawler with an unusual configuration maliciously.
Successful exploitation of this vulnerability could allow the attacker to access sensitive information, such as email addresses, default passwords, etc.
4. WordPress New Comments Modification Cross-Site Scripting Vulnerability
(
CVE-2018-20153
)
This vulnerability exists in Word Press due to an error while restricting new comments by the affected software. A remote attacker could exploit this vulnerability by modifying comments higher-privileged users and persuading them to open a crafted URL.
Successful exploitation of this vulnerability could allow the attacker to conduct cross site scripting attacks on the targeted system.
5. WordPress Apache HTTP Server MIME Type Restriction Bypass Cross-Site Scripting Vulnerability
(
CVE-2018-20149
)
This vulnerability exists in Word Press due to insufficient validation of user-supplied input processed by the affected software when using Apache HTTP Server. A remote attacker could exploit this vulnerability by persuading a user to execute a crafted file
Successful exploitation of this vulnerability could allow the attacker to bypass Multipurpose Internet Mail Extensions (MIME) type restrictions, resulting in cross site scripting attacks.
6. Restrictions Bypass Vulnerability
(
CVE-2018-20152
)
This vulnerability exists in Word Press due to insufficient post types restrictions by the affected software. A remote attacker could exploit this vulnerability by sending crafted input to a targeted system.
Successful exploitation of this vulnerability could allow the attacker to bypass restrictions on the targeted system which could lead to further attacks.
7. WordPress Plug-in Use Cases Cross-Site Scripting Vulnerability
(
CVE-2018-20150
)
This vulnerability exists in a plugin of Word Press due to insufficient validation of user-supplied input. A remote attacker could exploit this vulnerability by persuading a user to access a crafted URL on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to conduct cross site scripting attacks on the targeted system.
Solution
Apply appropriate fixes as issued by vendor in the following link
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
Vendor Information
WordPress
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
References
WordPress
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
Security Focus
https://www.securityfocus.com/bid/106220
Cisco
https://tools.cisco.com/security/center/viewAlert.x?alertId=59329
https://tools.cisco.com/security/center/viewAlert.x?alertId=59328
https://tools.cisco.com/security/center/viewAlert.x?alertId=59327
https://tools.cisco.com/security/center/viewAlert.x?alertId=59333
https://tools.cisco.com/security/center/viewAlert.x?alertId=59332
https://tools.cisco.com/security/center/viewAlert.x?alertId=59331
https://tools.cisco.com/security/center/viewAlert.x?alertId=59330
CVE Name
CVE-2018-20147
CVE-2018-20148
CVE-2018-20151
CVE-2018-20153
CVE-2018-20149
CVE-2018-20152
CVE-2018-20150
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|