CVE-2015-5730 Information disclosure in n/a
Remote attackers can exploit a timing side-channel in WordPress widget sanitization to potentially disclose sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5730?
CVE-2015-5730 is a medium-severity vulnerability in Wordpress Wordpress, published on 9 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Weakness: CWE-200
Which versions are affected by CVE-2015-5730?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2015-5730?
Upgrade to a fixed version.
Is CVE-2015-5730 being exploited?
There is no known exploitation of CVE-2015-5730 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2015-5730, GHSA-g4h2-wpj9-vf75.