CVE

Id
93716  
CVE No.
CVE-2016-6896  
Status
Candidate  
Description
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.  
Phase
Assigned (20160822)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794408 93716 CVE-2016-6896 MLIST:[oss-security] 20160820 Path traversal vulnerability in WordPress Core Ajax handlers  View
794409 93716 CVE-2016-6896 URL:http://www.openwall.com/lists/oss-security/2016/08/20/1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
5018 JVNDB-2016-005791 Microsoft Edge における Web コンテンツになりすまされる脆弱性 Microsoft Edge には、Web コンテンツになりすまされる脆弱性が存在します。 CVE-2016-7209 93716 2.6 5.3 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005791.html  View