CVE-2017-5493: Weak RNG
First published: Sun Jan 15 2017(Updated: )
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress | <=4.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2017/dsa-3779
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95401
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/8721
Frequently Asked Questions
What is the severity of CVE-2017-5493?
CVE-2017-5493 has been rated as a Medium severity vulnerability.
How do I fix CVE-2017-5493?
To fix CVE-2017-5493, upgrade your WordPress installation to version 4.7.1 or later.
What type of vulnerability is CVE-2017-5493?
CVE-2017-5493 is a cryptographic vulnerability that affects the random number generation for keys in WordPress.
Who is affected by CVE-2017-5493?
Users of WordPress versions prior to 4.7.1 are affected by CVE-2017-5493.
Can CVE-2017-5493 be exploited remotely?
Yes, CVE-2017-5493 can be exploited remotely by attackers to bypass access restrictions.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/wordpress
- canonical/wordpress
- version/wordpress/4.7