CVE-2019-17670: SSRF
Published Oct 17, 2019
·Updated
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
Affected Software
4 affected components
WordPress WordPress<5.2.4
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Patch Available
Event History
Oct 17, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2019-17670?
CVE-2019-17670 is a Server Side Request Forgery (SSRF) vulnerability in WordPress before version 5.2.4.
2
How severe is CVE-2019-17670?
CVE-2019-17670 has a severity rating of 9.8 out of 10, making it a critical vulnerability.
3
What is the affected software of CVE-2019-17670?
The affected software includes WordPress versions up to and excluding 5.2.4, as well as Debian Linux versions 8.0, 9.0, and 10.0.
4
How does CVE-2019-17670 exploit the vulnerability?
CVE-2019-17670 takes advantage of mishandling of Windows paths during certain validation of relative URLs.
5
How can I fix CVE-2019-17670?
To fix CVE-2019-17670, it is recommended to update to WordPress version 5.2.4 or later.