CVE-2014-0173
The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for…
Does this matter?
Lower severity and a low EPSS score (2.26%). Track it; it rarely justifies an emergency change on its own.
Description
The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 2.26% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- automattic/jetpack
- Source
- secalert@redhat.com
References
- http://jetpack.me/2014/04/10/jetpack-security-update/Vendor Advisory
- http://secunia.com/advisories/57729Vendor Advisory
- http://www.securityfocus.com/bid/66789
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92560
- http://jetpack.me/2014/04/10/jetpack-security-update/Vendor Advisory
- http://secunia.com/advisories/57729Vendor Advisory
- http://www.securityfocus.com/bid/66789
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92560
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.