Base Score

MEDIUM6.1

CVE-2018-10100

Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.

VectorNETWORK

Published Bycve@mitre.org

Published DateApr 16, 2018, 09:58

Weakness Type (CWE):CWE-601

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Severity

MEDIUM

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

NONE

References

http://www.securitytracker.com/id/1040836
https://codex.wordpress.org/Version_4.9.5
https://core.trac.wordpress.org/changeset/42892
https://github.com/WordPress/WordPress/commit/14bc2c0a6fde0da04b47130707e01df850eedc7e
https://lists.debian.org/debian-lts-announce/2018/04/msg00031.html
https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/
https://wpvulndb.com/vulnerabilities/9054
https://www.debian.org/security/2018/dsa-4193

Base Score

MEDIUM6.1

Weakness Type (CWE):CWE-601

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Severity

MEDIUM

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

NONE