CVE-2016-4029 | BDVDB-2026-77628 Detail

Description#

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securitytracker.com/id/1036594
https://wpvulndb.com/vulnerabilities/8473
http://codex.wordpress.org/Version_4.5
http://www.debian.org/security/2016/dsa-3681
https://core.trac.wordpress.org/query?status=closed&milestone=4.5

Exploit#

No public exploit known

History#

Version 12016-08-07Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.