CVE-2017-17091 - wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string

Back Back to CVE browser

HIGH

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string

Published Dec 2, 2017

8.8

HIGH

CVSS 3.0

EPSS 7.02%

Description

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-330

Insufficient Randomness

References (7)

http://www.securityfocus.com/bid/102024
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://codex.wordpress.org/Version_4.9.1
x_refsource_MISCPatchRelease Notes
https://github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c
x_refsource_MISCPatch
https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html
mailing-listx_refsource_MLIST
https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/
x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/8969
x_refsource_MISCThird Party AdvisoryVDB Entry
https://www.debian.org/security/2018/dsa-4090
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
http://www.securityfocus.com/bid/102024		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://codex.wordpress.org/Version_4.9.1		x_refsource_MISCPatchRelease Notes
https://github.com/WordPress/WordPress/commit/eaf1cfdc1fe0bdffabd8d879c591b864d833326c		x_refsource_MISCPatch
https://lists.debian.org/debian-lts-announce/2017/12/msg00019.html		mailing-listx_refsource_MLIST
https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/		x_refsource_MISCRelease Notes
https://wpvulndb.com/vulnerabilities/8969		x_refsource_MISCThird Party AdvisoryVDB Entry
https://www.debian.org/security/2018/dsa-4090		vendor-advisoryx_refsource_DEBIAN

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 2, 2017

Updated Aug 5, 2024

Reserved Dec 2, 2017

Link CVE-2017-17091

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-17091

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-17091