CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8
Authenticated users can exploit an XML parsing flaw in the Media Library to read internal files when running PHP 8.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29447?
CVE-2021-29447 is a high-severity vulnerability in Debian Debian Linux, published on 15 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
Weakness: CWE-611
Which versions are affected by CVE-2021-29447?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | From 5.6.0 | 5.7.1 |
wordpress-multisite Bitnami | From 5.6.0 | 5.7.1 |
Products include Debian Debian Linux, Wordpress Wordpress.
How do I fix CVE-2021-29447?
Upgrade wordpress to 5.7.1 or later.
Is CVE-2021-29447 being exploited?
There is no known exploitation of CVE-2021-29447 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 24 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-wordpress-2021-29447, BIT-wordpress-multisite-2021-29447, DEBIAN-CVE-2021-29447, GHSA-rv47-pc52-qrhh, UBUNTU-CVE-2021-29447.