CVE-2014-0173: Medium severity Automattic Jetpack Wordpress vulnerability

Published Apr 21, 2014

Updated

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.

Affected Software

35 affected components

Automattic Jetpack Wordpress=1.9

Automattic Jetpack Wordpress=1.9.1

Automattic Jetpack Wordpress=1.9.2

Automattic Jetpack Wordpress=2.0

Automattic Jetpack Wordpress=2.0.1

Automattic Jetpack Wordpress=2.0.2

Automattic Jetpack Wordpress=2.0.3

Automattic Jetpack Wordpress=2.0.4

Automattic Jetpack Wordpress=2.1

Automattic Jetpack Wordpress=2.1.1

Automattic Jetpack Wordpress=2.1.2

Automattic Jetpack Wordpress=2.2

Automattic Jetpack Wordpress=2.2.1

Automattic Jetpack Wordpress=2.2.2

Automattic Jetpack Wordpress=2.2.3

Automattic Jetpack Wordpress=2.2.4

Automattic Jetpack Wordpress=2.2.5

Automattic Jetpack Wordpress=2.3

Automattic Jetpack Wordpress=2.3.1

Automattic Jetpack Wordpress=2.3.2

Automattic Jetpack Wordpress=2.3.3

Automattic Jetpack Wordpress=2.3.4

Automattic Jetpack Wordpress=2.3.5

Automattic Jetpack Wordpress=2.4

Automattic Jetpack Wordpress=2.4.1

Automattic Jetpack Wordpress=2.4.2

Automattic Jetpack Wordpress=2.5

Automattic Jetpack Wordpress=2.6

Automattic Jetpack Wordpress=2.6.1

Automattic Jetpack Wordpress=2.7

Automattic Jetpack Wordpress=2.8

Automattic Jetpack Wordpress=2.9

Automattic Jetpack Wordpress=2.9.1

Automattic Jetpack Wordpress=2.9.2

Automattic Jetpack Wordpress=2.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 1.9.4
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.0.9
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.1.4
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.2.7
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.3.7
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.4.4
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.5.2
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.6.3
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.7.2
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.8.2
Upgrade
Upgrade WordPress Jetpack plugin to a version that resolves this vulnerability.
Fixed in 2.9.3

Event History

Apr 21, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Apr 22, 2014

Data Sourced

via NVD·01:06 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0173?

CVE-2014-0173 is rated as a medium severity vulnerability due to its potential for unauthorized access.

How do I fix CVE-2014-0173?

To fix CVE-2014-0173, you should update the Jetpack plugin to a version later than 2.9.3.

What versions of Jetpack are affected by CVE-2014-0173?

CVE-2014-0173 affects Jetpack versions 1.9 through 2.9.2.

What type of vulnerability is CVE-2014-0173?

CVE-2014-0173 is an access control vulnerability that allows unauthenticated access to certain features.

Who is the vendor of the software affected by CVE-2014-0173?

The vendor of the affected software is Automattic, which develops the Jetpack plugin for WordPress.