| Vulnerability Name: | CVE-2016-6896 (CCN-116336) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-08-20 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-08-20 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-09-03 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) 6.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-22 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-6896 Source: CCN Type: SECTRACK ID: 1036683 WordPress Bugs Let Remote Users Conduct Cross-Site Request Forgery Attacks and Remote Authenticated Users Deny Service Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20160820 Path traversal vulnerability in WordPress Core Ajax handlers Source: SECTRACK Type: UNKNOWN 1036683 Source: XF Type: UNKNOWN wordpress-core-ajax-cve20166896-dos(116336) Source: CCN Type: Summer of Pwnage Web site Summer of Pwnage Web site - Path traversal vulnerability in WordPress Core Ajax handlers Source: MISC Type: Exploit, Technical Description, Third Party Advisory https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html Source: CCN Type: WordPress Web site Blog Tool, Publishing Platform, and CMS WordPress Source: MISC Type: UNKNOWN https://wpvulndb.com/vulnerabilities/8606 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [08-22-2016] Source: EXPLOIT-DB Type: UNKNOWN 40288 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||