CVE-2015-5730

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for…

published November 9, 2015

CVSS
—
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07341 · 94.4th percentile
Published
2015-11-09T11:00Z
EPSS history
Timeline
  • 09 NOV 11:00Z
    The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for…
    cvelistv5