CVE-2017-9066: In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF

High severity · published May 18, 2017

CVE-2017-9066

In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF

8.6

CVSS

3.7%

EPSS

On KEV

Description

In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)3.7% · higher than 90% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WordPress · WordPress

through 4.7.4 · source: NVD

Debian Linux · Debian

8.0; 9.0 · source: NVD

Affected product

WordPress

All WordPress CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-9066

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-9066

Third Party Advisory

http://www.securityfocus.com/bid/98509

Third Party Advisory

http://www.securitytracker.com/id/1038520

Patch

https://codex.wordpress.org/Version_4.7.5

Patch

https://github.com/WordPress/WordPress/commit/76d77e927bb4d0f87c7262a50e28d84e01fd2b11

Third Party Advisory

https://twitter.com/skansing/status/865362551097393153

Patch

https://wordpress.org/news/2017/05/wordpress-4-7-5/