NVD

Id
7125  
Name
CVE-2017-5487  
Description
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-07-18  
Published
2017-01-14  
Modified Date
2017-07-17  
Seq
2017-5487  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
39868 7125 CVE-2017-5487 [oss-security] 20170114 Re: CVE Request: Wordpress: 8 security issues in 4.7  View
39869 7125 CVE-2017-5487 95391  View
39870 7125 CVE-2017-5487 https://codex.wordpress.org/Version_4.7.1  View
39871 7125 CVE-2017-5487 https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60  View
39872 7125 CVE-2017-5487 https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/  View
39873 7125 CVE-2017-5487 https://www.wordfence.com/blog/2016/12/wordfence-blocks-username-harvesting-via-new-rest-api-wp-4-7/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
64701 JVNDB-2017-001088 WordPress の REST API の実装における重要な情報を取得される脆弱性 WordPress の REST API の実装の wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php は、投稿作成者のリストを適切に制限しないため、重要な情報を取得される脆弱性が存在します。 CVE-2017-5487 CVE-2017-5487 7125 5 5.3 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-001088.html 2017-01-11 2017-01-26 View