Strix
26.1K

CVE-2017-1001000

UnknownEPSS 81.85%

Last modified

CVE-2017-1001000 is a vulnerability of currently unknown severity. The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.. EPSS estimates a 81.85% chance of exploitation in the next 30 days.

Description

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.

Metrics

EPSS Probability
81.85%

99.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
WordpressWordpress4.7
WordpressWordpress4.7.1
WordpressWordpress4.7.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-1001000?
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.
How severe is CVE-2017-1001000?
Severity scoring for CVE-2017-1001000 is pending analysis. The EPSS model estimates a 81.85% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1001000?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2017

View all 2017CVEs →

Are you affected by CVE-2017-1001000?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST