[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] Cross-Site Request Forgery in WordPress Press This function allows DoS
- To: fulldisclosure@xxxxxxxxxxxx
- Subject: [FD] Cross-Site Request Forgery in WordPress Press This function allows DoS
- From: Summer of Pwnage <lists@xxxxxxxxxxx>
- Date: Tue, 7 Mar 2017 00:00:30 +0100
------------------------------------------------------------------------
Cross-Site Request Forgery in WordPress Press This function allows DoS
------------------------------------------------------------------------
Sipke Mellema, July 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Request Forgery (CSRF) vulnerability exists on the Press
This page of WordPress. This issue can be used to create a Denial of
Service (DoS) condition if an authenticated administrator visits a
malicious URL.
------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160718-0005
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on WordPress version 4.5.3.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in WordPress version 4.7.3.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_function_allows_dos.html
------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/