{"api_version":"1","generated_at":"2026-07-23T08:50:50+00:00","cve":"CVE-2017-5493","urls":{"html":"https://cve.report/CVE-2017-5493","api":"https://cve.report/api/cve/CVE-2017-5493.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-5493","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-5493"},"summary":{"title":"CVE-2017-5493","description":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2017-01-15 02:59:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-338"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/14/6","name":"[oss-security] 20170114 Re: CVE Request: Wordpress: 8 security issues in 4.7","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"oss-security - Re: CVE Request: Wordpress: 8 security issues in 4.7","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://codex.wordpress.org/Version_4.7.1","name":"https://codex.wordpress.org/Version_4.7.1","refsource":"CONFIRM","tags":["Release Notes","Vendor Advisory"],"title":"Version 4.7.1 « WordPress Codex","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/95401","name":"95401","refsource":"BID","tags":[],"title":"WordPress Cryptographic Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4","name":"https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4","refsource":"CONFIRM","tags":["Patch"],"title":"Multisite: Use `wp_rand()` in signup key creation. · WordPress/WordPress@cea9e2d · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1037591","name":"1037591","refsource":"SECTRACK","tags":[],"title":"WordPress Bugs Let Remote Users Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks and Obtain Potentially Sensitive Information - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2017/dsa-3779","name":"DSA-3779","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-3779-1 wordpress","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/","name":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"WordPress 4.7.1 Security and Maintenance Release","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wpvulndb.com/vulnerabilities/8721","name":"https://wpvulndb.com/vulnerabilities/8721","refsource":"MISC","tags":[],"title":"WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG)","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5493","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5493","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"5493","vulnerable":"1","versionEndIncluding":"4.7","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wordpress","cpe5":"wordpress","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-5493","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://wpvulndb.com/vulnerabilities/8721","refsource":"MISC","url":"https://wpvulndb.com/vulnerabilities/8721"},{"name":"95401","refsource":"BID","url":"http://www.securityfocus.com/bid/95401"},{"name":"DSA-3779","refsource":"DEBIAN","url":"http://www.debian.org/security/2017/dsa-3779"},{"name":"https://codex.wordpress.org/Version_4.7.1","refsource":"CONFIRM","url":"https://codex.wordpress.org/Version_4.7.1"},{"name":"[oss-security] 20170114 Re: CVE Request: Wordpress: 8 security issues in 4.7","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2017/01/14/6"},{"name":"1037591","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037591"},{"name":"https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4","refsource":"CONFIRM","url":"https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d1aaa49b29f4"},{"name":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/","refsource":"CONFIRM","url":"https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/"}]}},"nvd":{"publishedDate":"2017-01-15 02:59:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-338"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionEndIncluding":"4.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"5493","Ordinal":"102025","Title":"CVE-2017-5493","CVE":"CVE-2017-5493","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"5493","Ordinal":"1","NoteData":"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"5493","Ordinal":"2","NoteData":"2017-01-14","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"5493","Ordinal":"3","NoteData":"2017-11-03","Type":"Other","Title":"Modified"}]}}}