CVE-2014-5266: Medium severity wordpress vulnerability
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5266?
CVE-2014-5266 is classified as a high severity vulnerability due to its potential to cause denial of service through excessive CPU consumption.
How do I fix CVE-2014-5266?
To fix CVE-2014-5266, update WordPress to version 3.9.2 or later, and Drupal to version 6.33 or 7.31 or later.
What systems are affected by CVE-2014-5266?
CVE-2014-5266 affects WordPress versions prior to 3.9.2 and Drupal versions prior to 6.33 and 7.31.
What kind of attack does CVE-2014-5266 allow?
CVE-2014-5266 allows remote attackers to conduct denial of service attacks by sending large XML documents.
Is there a workaround for CVE-2014-5266?
Implementing input validation to limit the size of incoming XML documents can serve as a temporary workaround for CVE-2014-5266.