CVE-2016-5835 - Vulnerability Details - OpenCVE

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress	Wordpress

Configuration 1 [-]

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.debian.org/security/2016/dsa-3639
http://www.securityfocus.com/bid/91366
http://www.securitytracker.com/id/1036163
https://codex.wordpress.org/Version_4.5.3
https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1
https://wordpress.org/news/2016/06/wordpress-4-5-3/
https://wpvulndb.com/vulnerabilities/8519

History

No history.

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2016-06-29T14:00:00

Updated: 2024-08-06T01:15:10.797Z

Reserved: 2016-06-23T00:00:00

Link: CVE-2016-5835

Vulnrichment

No data.

NVD

Status : Modified

Published: 2016-06-29T14:10:06.960

Modified: 2024-11-21T02:55:06.150

Link: CVE-2016-5835

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-06-18T00:00:00", "descriptions": [{"lang": "en", "value": "WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-28T20:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/news/2016/06/wordpress-4-5-3/"}, {"name": "91366", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/91366"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://codex.wordpress.org/Version_4.5.3"}, {"name": "1036163", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1036163"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1"}, {"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/8519"}, {"name": "DSA-3639", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3639"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2016-5835", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://wordpress.org/news/2016/06/wordpress-4-5-3/", "refsource": "CONFIRM", "url": "https://wordpress.org/news/2016/06/wordpress-4-5-3/"}, {"name": "91366", "refsource": "BID", "url": "http://www.securityfocus.com/bid/91366"}, {"name": "https://codex.wordpress.org/Version_4.5.3", "refsource": "CONFIRM", "url": "https://codex.wordpress.org/Version_4.5.3"}, {"name": "1036163", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036163"}, {"name": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1", "refsource": "CONFIRM", "url": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1"}, {"name": "https://wpvulndb.com/vulnerabilities/8519", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/8519"}, {"name": "DSA-3639", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3639"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:15:10.797Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/news/2016/06/wordpress-4-5-3/"}, {"name": "91366", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/91366"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://codex.wordpress.org/Version_4.5.3"}, {"name": "1036163", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1036163"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpvulndb.com/vulnerabilities/8519"}, {"name": "DSA-3639", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3639"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2016-5835", "datePublished": "2016-06-29T14:00:00", "dateReserved": "2016-06-23T00:00:00", "dateUpdated": "2024-08-06T01:15:10.797Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FD1C123-A5DE-4665-BC7B-46996C86E185", "versionEndIncluding": "4.5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php."}, {"lang": "es", "value": "WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos obtener informaci\u00f3n sensible del hist\u00f3rico de revisi\u00f3n aprovechando la habilidad para leer un post relacionado con wp-admin/includes/ajax-actions.php y wp-admin/revision.php."}], "id": "CVE-2016-5835", "lastModified": "2024-11-21T02:55:06.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-06-29T14:10:06.960", "references": [{"source": "security@debian.org", "url": "http://www.debian.org/security/2016/dsa-3639"}, {"source": "security@debian.org", "url": "http://www.securityfocus.com/bid/91366"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://www.securitytracker.com/id/1036163"}, {"source": "security@debian.org", "tags": ["Release Notes"], "url": "https://codex.wordpress.org/Version_4.5.3"}, {"source": "security@debian.org", "url": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1"}, {"source": "security@debian.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://wordpress.org/news/2016/06/wordpress-4-5-3/"}, {"source": "security@debian.org", "url": "https://wpvulndb.com/vulnerabilities/8519"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2016/dsa-3639"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/91366"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.securitytracker.com/id/1036163"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://codex.wordpress.org/Version_4.5.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/WordPress/WordPress/commit/a2904cc3092c391ac7027bc87f7806953d1a25a1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://wordpress.org/news/2016/06/wordpress-4-5-3/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://wpvulndb.com/vulnerabilities/8519"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}