Is CVE-2017-5490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5490 being exploited in the wild.

How severe is CVE-2017-5490?

Medium severity, with a CVSS score of 6.1, published 15 January 2017.

Is there a fix for CVE-2017-5490?

A patch was published on 2017-01-11: Fixed in WordPress version 4.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5490 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5490?

Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5490: WordPress XSS in theme-name fallback functionality

CVE-2017-5490 · Severity: medium · CVSS 6.1 · Published 2017-01-15

WordPress is a widely used content management system for building websites and blogs. A security flaw was identified where the system failed to properly clean theme names when displaying them in the administrative dashboard. If an attacker can trick an administrator into interacting with a specially named theme directory, they could execute malicious scripts in the administrator's browser, potentially leading to unauthorized site changes or account takeover.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2017-5490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5490 being exploited in the wild.
How severe is CVE-2017-5490?: Medium severity, with a CVSS score of 6.1, published 15 January 2017.
Which products and versions are affected?: WordPress WordPress < 4.7.1.
Is there a fix for CVE-2017-5490?: A patch was published on 2017-01-11: Fixed in WordPress version 4.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5490 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5490?: Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in WordPress versions prior to 4.7.1. The flaw is located in the theme-name fallback functionality within `wp-includes/class-wp-theme.php` and is related to how `wp-admin/includes/class-theme-installer-skin.php` handles theme metadata. The root cause is insufficient sanitization of the theme directory name when the theme's 'Name' header is missing or invalid. An attacker can exploit this by providing a crafted directory name containing HTML or JavaScript. When an administrator views the theme details or installation status, the script executes in their security context. This issue was patched in WordPress 4.7.1 by ensuring proper escaping of the fallback theme name.

Affected products

WordPress WordPress < 4.7.1

Timeline

2017-01-11: patched: Fixed in WordPress version 4.7.1
2017-01-14: disclosed: Public disclosure via WordPress security release notes
2017-01-15: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.