Test ID:	1.3.6.1.4.1.25623.1.0.891980
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-1980-1)
Summary:	The remote host is missing an update for the Debian 'wordpress' package(s) announced via the DLA-1980-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'wordpress' package(s) announced via the DLA-1980-1 advisory. Vulnerability Insight: Several vulnerabilities in wordpress, a web blogging tool, have been fixed. CVE-2019-17669 Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. CVE-2019-17670 Server Side Request Forgery (SSRF) vulnerability was reported in wp_validate_redirect(). Normalize the path when validating the location for relative URLs. CVE-2019-17671 Unauthenticated viewing of certain content (private or draft posts) is possible because the static query property is mishandled. CVE-2019-17675 Wordpress does not properly consider type confusion during validation of the referer in the admin pages. This vulnerability affects the check_admin_referer() WordPress function. For Debian 8 Jessie, these problems have been fixed in version 4.1.28+dfsg-0+deb8u1. We recommend that you upgrade your wordpress packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'wordpress' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-17669 Bugtraq: 20200108 [SECURITY] [DSA 4599-1] wordpress security update (Google Search) https://seclists.org/bugtraq/2020/Jan/8 Debian Security Information: DSA-4599 (Google Search) https://www.debian.org/security/2020/dsa-4599 Debian Security Information: DSA-4677 (Google Search) https://www.debian.org/security/2020/dsa-4677 https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html https://core.trac.wordpress.org/changeset/46475 https://github.com/WordPress/WordPress/commit/608d39faed63ea212b6c6cdf9fe2bef92e2120ea https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/ https://wpvulndb.com/vulnerabilities/9912 https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17670 https://core.trac.wordpress.org/changeset/46472 https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2 https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html https://lists.debian.org/debian-lts-announce/2022/10/msg00010.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17671 https://core.trac.wordpress.org/changeset/46474 https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308 https://wpvulndb.com/vulnerabilities/9909 Common Vulnerability Exposure (CVE) ID: CVE-2019-17675 https://core.trac.wordpress.org/changeset/46477 https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0 https://wpvulndb.com/vulnerabilities/9913
Copyright	Copyright (C) 2019 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.