CVE-2017-8295

Name	CVE-2017-8295
Description	WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-975-1, DSA-3870-1
Debian Bugs	862053

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wordpress (PTS)	jessie, jessie (lts)	4.1.35+dfsg-0+deb8u1	fixed
	stretch (security), stretch (lts), stretch	4.7.23+dfsg-0+deb9u1	fixed
	buster	5.0.15+dfsg1-0+deb10u1	fixed
	buster (security)	5.0.21+dfsg1-0+deb10u1	fixed
	bullseye (security), bullseye	5.7.8+dfsg1-0+deb11u2	fixed
	bookworm	6.1.1+dfsg1-1	fixed
	sid, trixie	6.5+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
wordpress	source	wheezy	3.6.1+dfsg-1~deb7u15	DLA-975-1
wordpress	source	jessie	4.1+dfsg-1+deb8u14	DSA-3870-1
wordpress	source	(unstable)	4.7.5+dfsg-2		862053

Notes

https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html
http://blog.dewhurstsecurity.com/2017/05/04/exploitbox-wordpress-security-advisories.html
https://core.trac.wordpress.org/ticket/25239
https://core.trac.wordpress.org/changeset/48601 (5.5)