W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify
2019-05-07 00:00
AnonymousStrategic Overview
Vulnerability Overview
W3 Total Cache in versions 0.5 up to 0.9.7.3 does not sufficiently validate the "openssl_verify" result in "/services/MessageValidator/MessageValidator.php". A remote attacker can create a specially crafted certificate and bypass cryptographic checks.
Technical Analysis
REMEDIATION: Update to version 0.9.7.4, or a newer patched version --- IDENTIFIER: CWE-20 (Improper Input Validation) The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C