Test ID:	1.3.6.1.4.1.25623.1.0.108155
Category:	Web application abuses
Title:	WordPress Password Reset CVE-2017-8295 Security Bypass Vulnerability - Linux
Summary:	WordPress is prone to a security bypass vulnerability.
Description:	Summary: WordPress is prone to a security bypass vulnerability. Vulnerability Insight: The flaws exist because WordPress relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for user-assisted remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this e-mail to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Vulnerability Impact: Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. Affected Software/OS: WordPress versions 4.7.4 and prior. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. A workaround is to enable UseCanonicalName to enforce static SERVER_NAME value. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-8295 BugTraq ID: 98295 http://www.securityfocus.com/bid/98295 Debian Security Information: DSA-3870 (Google Search) http://www.debian.org/security/2017/dsa-3870 https://www.exploit-db.com/exploits/41963/ https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html https://wpvulndb.com/vulnerabilities/8807 http://www.securitytracker.com/id/1038403
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.