| Vulnerability Name: | CVE-2015-5715 (CCN-107850) | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2015-10-26 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2015-10-26 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-11-04 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) 3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-264 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2015-5715 Source: CCN Type: oss-sec Mailing List, Mon, 26 Oct 2015 20:32:44 +0100 CVE Request: Wordpress: Cross-site scripting vulnerability in the user list table Source: CCN Type: oss-sec Mailing List, Wed, 28 Oct 2015 00:55:17 -0400 (EDT) Re: CVE Request: Wordpress: Cross-site scripting vulnerability in the user list table Source: CCN Type: SECTRACK ID: 1033979 WordPress Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Bypass Publishing Permission Checks Source: DEBIAN Type: UNKNOWN DSA-3375 Source: DEBIAN Type: UNKNOWN DSA-3383 Source: BID Type: UNKNOWN 76748 Source: CCN Type: BID-76748 WordPress CVE-2015-5715 Security Bypass Vulnerability Source: SECTRACK Type: UNKNOWN 1033979 Source: CONFIRM Type: Patch, Vendor Advisory https://codex.wordpress.org/Version_4.3.1 Source: XF Type: UNKNOWN wordpress-cve20155715-sec-bypass(107850) Source: CONFIRM Type: Patch https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab Source: CONFIRM Type: UNKNOWN https://security-tracker.debian.org/tracker/CVE-2015-5715 Source: CCN Type: WordPress Web Site WordPress 4.3.1 Security and Maintenance Release Source: CONFIRM Type: Patch, Vendor Advisory https://wordpress.org/news/2015/09/wordpress-4-3-1/ Source: MISC Type: UNKNOWN https://wpvulndb.com/vulnerabilities/8188 Source: CCN Type: WhiteSource Vulnerability Database CVE-2015-5715 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||