vulnwire
5.9med

CVE-2017-82951 exploit

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to r…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
26.7%
percentile 98%
Public exploits
1
Exploit-DB

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.

Exploit prediction (EPSS)

26.70% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-41963 WordPress Core < 4.7.4 - Unauthorized Password Reset · webapps · 2017-05-03

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Technology feeds
WordPress (RSS, critical only)

References

  • exploit-db.com /exploits/41963/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • exploitbox.io /vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html · x_refsource_MISC, x_transferred
  • debian.org /security/2017/dsa-3870 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securitytracker.com /id/1038403 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/98295 · vdb-entry, x_refsource_BID, x_transferred
  • wpvulndb.com /vulnerabilities/8807 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.