CVE

Id
93717  
CVE No.
CVE-2016-6897  
Status
Candidate  
Description
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.  
Phase
Assigned (20160822)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794410 93717 CVE-2016-6897 MLIST:[oss-security] 20160820 Path traversal vulnerability in WordPress Core Ajax handlers  View
794411 93717 CVE-2016-6897 URL:http://www.openwall.com/lists/oss-security/2016/08/20/1  View
794412 93717 CVE-2016-6897 MISC:https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html  View
794413 93717 CVE-2016-6897 CONFIRM:https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568  View
794414 93717 CVE-2016-6897 BID:92572  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
5075 JVNDB-2016-005848 複数の Microsoft Windows 製品の atmfd.dll におけるプロセスメモリから重要な情報を取得される脆弱性 複数の Microsoft Windows 製品の atmfd.dll には、プロセスメモリから重要な情報を取得される脆弱性が存在します。 CVE-2016-7210 93717 4.3 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-005848.html  View