CVE-2017-5487 in WordPress

Sumário (Inglês)

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

Once again VulDB remains the best source for vulnerability data.

Reservar

14/01/2017

Divulgação

14/01/2017

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
95347	WordPress REST API class-wp-rest-users-controller.php Divulgação de Informação	200	Funcional	Correção oficial	CVE-2017-5487

Fontes

• MITRE
• NVD
• CVE Details