CVE-2017-1000600
Published: 6 September 2018
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
Priority
Status
Package | Release | Status |
---|---|---|
wordpress
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.9.5+dfsg1-1)
|
cosmic |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
disco |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
eoan |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
focal |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
groovy |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
hirsute |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
impish |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
jammy |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
kinetic |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
lunar |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
mantic |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
noble |
Not vulnerable
(4.9.5+dfsg1-1)
|
|
trusty |
Does not exist
(trusty was needed)
|
|
upstream |
Released
(4.9)
|
|
xenial |
Needed
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.8 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |