onyx --cves cve-2018-10100
CVE-2018-10100
- score
- <0.1
- cvss
- 6.1
- epss
- 2.6%
- published
- 2018-04-16
- kev added
- —
- first seen
WordPress before 4.9.5 contains an unvalidated redirection URL in the login page caused by lack of validation or sanitization when forcing HTTPS, letting attackers perform open redirect attacks, exploit requires no special privileges.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 8
- https://lists.debian.org/debian-lts-announce/2018/04/msg00031.html
- https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/9054
- https://www.debian.org/security/2018/dsa-4193
- https://codex.wordpress.org/Version_4.9.5
- https://core.trac.wordpress.org/changeset/42892
- http://www.securitytracker.com/id/1040836
- https://github.com/WordPress/WordPress/commit/14bc2c0a6fde0da04b47130707e01df850eedc7e