onyx --cves cve-2017-17094
CVE-2017-17094
- score
- <0.1
- cvss
- 5.4
- epss
- 2.0%
- published
- 2017-12-02
- kev added
- —
- first seen
WordPress before 4.9.1 contains a reflected cross-site scripting caused by improper restriction of enclosures in RSS and Atom fields in wp-includes/feed.php, letting attackers execute malicious scripts via crafted URLs, exploit requires attacker to craft malicious URL.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 7
- https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
- http://www.securityfocus.com/bid/102024
- https://github.com/WordPress/WordPress/commit/f1de7e42df29395c3314bf85bff3d1f4f90541de
- https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html
- https://wpvulndb.com/vulnerabilities/8967
- https://www.debian.org/security/2018/dsa-4090
- https://codex.wordpress.org/Version_4.9.1