CVE-2017-16870 Server-side request forgery in n/a
An attacker can exploit Server-Side Request Forgery in the UpdraftPlus WordPress plugin to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16870?
CVE-2017-16870 is a high-severity server-side request forgery vulnerability in n/a, published on 17 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
Weakness: CWE-918
Which versions are affected by CVE-2017-16870?
It affects 1 product.
Products include Updraftplus Updraftplus.
How do I fix CVE-2017-16870?
No fix has been published for CVE-2017-16870 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-16870 being exploited?
There is no known exploitation of CVE-2017-16870 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-16871 Race condition in n/a
- CVE-2023-32960 WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2022-0633 UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download
- CVE-2022-0864 UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting
- CVE-2021-25089 UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting
Sources
Also known as GHSA-h822-qcq8-pf95.