CVE-2017-6814
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.9%
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
Produtos afetados
n/a · n/aReferências
http://openwall.com/lists/oss-security/2017/03/06/8https://codex.wordpress.org/Version_4.7.3https://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4e5f52796bd7https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is_affected_by_cross_site_scripting.htmlhttps://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/https://wpvulndb.com/vulnerabilities/8765http://www.debian.org/security/2017/dsa-3815http://www.securityfocus.com/bid/96601http://www.securitytracker.com/id/1037959