ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2016-4029

—
CVSS 3.1
8.6 high
EPSS
4%p89
Published
()
Modified
Description

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

Vendors
wordpressdebian
Products
wordpress, debian linux
Ecosystems
WordPress
Weakness
CWE-918
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (3.5%)

In the news

No ingested article mentions this CVE yet.