Intel

CVE-2014-5266

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the n… (CVE-2014-5266)

noneEPSS 24%

Description

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.

Source: CVELISTV5NVD

Metrics

Severity
none
Priority score
58.63
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
97.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
24.4 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2014-08-18 10:00 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux7.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • drupal

    drupal

  • wordpress

    wordpress3.9.1

  • wordpress

    wordpress

References & sources

IDCVE-2014-5266