Lucene search
Dawid GolunskiPATCHSTACK:15B8EC4221D09F3BD86571878FF519E7HistoryMay 03, 2017 - 12:00 a.m.
WordPress <=4.7.4 - Host Header Injection in Password Reset
2017-05-0300:00:00
Dawid Golunski
patchstack.com
24
EPSS
0.026
Percentile
90.4%
The issue with the SERVER_NAME and PHP mail function allow an attacker to trick the WordPress send the password reset (crafted wp-login.php?action=lostpassword request) mail to the attackers SMTP server.
Solution
Update WordPress to the latest possible version (at least 4.7.5)
Related
cvelist
cvelist
CVE-2017-8295
2017-05-04 14:00:00
attackerkb
attackerkb
CVE-2017-8295
2017-05-04 00:00:00
hackerone
hackerone
Nextcloud: Wordpress Vulnerable to Potential Unauthorized Password Reset
2017-05-04 08:31:19
threatpost
threatpost
Unpatched WordPress Password Reset Vulnerability Lingers
2017-05-04 12:46:02
WordPress Fixes CSRF, XSS Bugs, Announces Bug Bounty Program
2017-05-18 14:17:00
wpvulndb
wpvulndb
WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
2017-05-03 00:00:00
zdt
zdt
WordPress < 4.7.4 - Unauthorized Password Reset Vulnerability
2017-05-04 00:00:00
veracode
veracode
Unauthorized Access
2017-08-03 08:38:00
debiancve
debiancve
CVE-2017-8295
2017-05-04 14:29:00
prion
prion
Default credentials
2017-05-04 14:29:00
nessus
nessus
WordPress 2.3.0 - 4.8.3 Unauthorized Password Reset
2017-05-09 00:00:00
Debian DSA-3870-1 : wordpress - security update
2017-06-01 00:00:00
Debian DLA-975-1 : wordpress security update
2017-06-05 00:00:00
nvd
nvd
CVE-2017-8295
2017-05-04 14:29:00
cve
cve
CVE-2017-8295
2017-05-04 14:29:00
wpexploit
wpexploit
WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
2017-05-03 00:00:00
checkpoint_advisories
checkpoint_advisories
WordPress Unauthorized Password Reset (CVE-2017-8295)
2017-05-07 00:00:00
thn
thn
Unpatched Wordpress Flaw Could Allow Hackers To Reset Admin Password
2017-05-04 07:11:00
ubuntucve
ubuntucve
CVE-2017-8295
2017-05-04 00:00:00
osv
osv
CVE-2017-8295
2017-05-04 14:29:00
wordpress - security update
2017-06-01 00:00:00
wordpress - security update
2017-06-02 00:00:00
exploitpack
exploitpack
WordPress 4.7.4 - Unauthorized Password Reset
2017-05-03 00:00:00
exploitdb
exploitdb
WordPress Core < 4.7.4 - Unauthorized Password Reset
2017-05-03 00:00:00
openvas
openvas
WordPress Password Reset CVE-2017-8295 Security Bypass Vulnerability - Linux
2017-05-08 00:00:00
Debian Security Advisory DSA 3870-1 (wordpress - security update)
2017-06-01 00:00:00
seebug
seebug
WordPress Core 4.6 - Unauthenticated Remote Code Execution
2017-05-04 00:00:00
debian
debian
[SECURITY] [DLA 975-1] wordpress security update
2017-06-02 12:47:52
[SECURITY] [DSA 3870-1] wordpress security update
2017-06-01 05:31:44
[SECURITY] [DSA 3870-1] wordpress security update
2017-06-01 05:31:44