CVSS: 5.7EPSS: 0%CPEs: 23EXPL: 0CVE-2020-4048 – Open redirect in wp_validate_redirect() in WordPress
https://notcve.org/view.php?id=CVE-2020-4048
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). En las versiones afectadas de WordPress, debido a un problema en la función wp_validate_redirect() y el saneamiento de URL, se puede crear un enlace externo arbitrario que puede conllevar a una redireccionamiento abierto involuntario al hacer clic. Esto ha sido parcheado en la versión 5.4.2, junto con todas las versiones afectadas anteriormente por medio de una versión menor (versiones 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34) • https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5 https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25286 – WordPress Core < 5.4.2 - Comment Disclosure
https://notcve.org/view.php?id=CVE-2020-25286
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. En el archivo wp-includes/comment-template.php en WordPress versiones anteriores a 5.4.2, los comentarios de una publicación o página podrían algunas veces ser vistos en los últimos comentarios, inclusive si la publicación o la página no eran públicas • https://core.trac.wordpress.org/changeset/47984 https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.0EPSS: 0%CPEs: 23EXPL: 0CVE-2020-4050 – set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
https://notcve.org/view.php?id=CVE-2020-4050
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). En las versiones afectadas de WordPress, el uso incorrecto del valor de retorno del filtro "set-screen-option", permite que campos meta arbitrarios del usuario sean guardados. • https://github.com/WordPress/wordpress-develop/commit/b8dea76b495f0072523106c6ec46b9ea0d2a0920 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqc https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 6.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-4047 – Authenticated XSS via media attachment page in WordPress
https://notcve.org/view.php?id=CVE-2020-4047
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). En las versiones afectadas de WordPress, los usuarios autenticados con permisos de carga (como los autores) pueden inyectar JavaScript en algunas páginas de archivos adjuntos multimedia de determinada manera. Esto puede conllevar a una ejecución de script en el contexto de un usuario con mayores privilegios cuando el archivo es visualizado por ellos. • https://github.com/WordPress/wordpress-develop/commit/0977c0d6b241479ecedfe19e96be69f727c3f81f https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8q2w-5m27-wm27 https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-11028 – Unauthenticated disclosure of certain private posts in WordPress
https://notcve.org/view.php?id=CVE-2020-11028
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). En las versiones afectadas de WordPress, algunas publicaciones privadas, que anteriormente eran públicas, pueden resultar en una divulgación no autenticada bajo un conjunto específico de condiciones. Esto ha sido corregido en la versión 5.4.1, junto con todas las versiones afectadas anteriormente mediante una versión menor (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xhx9-759f-6p2w https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates https://www.debian.org/security/2020/dsa-4677 • CWE-284: Improper Access Control CWE-306: Missing Authentication for Critical Function •