CVE-2014-9038
MEDIUM
6.4
CVSS 2.0
Description
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.
Affected WordPress components
-
WordPress coreUp to and including 3.7.4; Version 3.8; Version 3.8.1; Version 3.8.2; Version 3.8.3; Version 3.8.4; Version 3.9; Version 3.9.1; Version 3.9.2; Version 4.0
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Up to and including 3.7.4
- wordpress wordpress — Version 3.8
- wordpress wordpress — Version 3.8.1
- wordpress wordpress — Version 3.8.2
- wordpress wordpress — Version 3.8.3
- wordpress wordpress — Version 3.8.4
- wordpress wordpress — Version 3.9
- wordpress wordpress — Version 3.9.1
- wordpress wordpress — Version 3.9.2
- wordpress wordpress — Version 4.0
References
- advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0493.html
- openwall.com http://openwall.com/lists/oss-security/2014/11/25/12
- www.debian.org http://www.debian.org/security/2014/dsa-3085
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
- www.securitytracker.com http://www.securitytracker.com/id/1031243
- core.trac.wordpress.org https://core.trac.wordpress.org/changeset/30444 Vendor Advisory
- wordpress.org https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
- nvd.nist.gov Official NVD record