[ASA-202011-3] wordpress: multiple issues

🗓️ 03 Nov 2020 00:00:00Reported by ArchLinuxType

archlinux🔗 security.archlinux.org👁 39 Views

wordpress multiple issues including arbitrary code execution, cross-site request forgery, cross-site scripting, insufficient validation and privilege escalation affecting versions before 5.5.3-

Reporter	Title	Published	Views	Family All 196
BDU FSTEC	The vulnerability of the WordPress website content management system, related to deficiencies in access control for certain functions, allows attackers to compromise data integrity.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the wp-includes/Requests/Utility/FilteredIterator.php component of the WordPress content management system, related to the restoration of unreliable data structures in memory, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the WordPress website content management system, related to deficiencies in mechanisms for combating cross-site fraud, allows attackers to compromise the integrity of data.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the is_protected_meta function in the wp-includes/meta.php component of the WordPress content management system, related to improper access control, allows attackers to compromise data integrity and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the WordPress website content management system, related to deficiencies in the security measures used to protect web page structures, allows attackers to compromise data integrity.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the is_blog_installed function (wp-includes/functions.php) in the WordPress content management system involves a lack of input validation mechanisms. This allows attackers to access sensitive data, compromise its integrity, and cause service interruptions.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the wp-includes/class-wp-xmlrpc-server.php component of the WordPress content management system, related to a lack of privilege management mechanisms, allows attackers to access confidential data, compromise its integrity, and cause service interruptions.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the WordPress website content management system lies in the lack of a mechanism for managing privileges. This allows attackers to access confidential data, compromise its integrity, and cause service failures.	30 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the WordPress website content management system, related to deficiencies in the security measures used to protect web page structures, allows attackers to compromise data integrity.	30 Mar 202100:00	–	bdu_fstec
GithubExploit	Exploit for Deserialization of Untrusted Data in Wordpress	17 Nov 202107:09	–	githubexploit

OS	OS Version	Architecture	Package	Package Version	Filename
Arch Linux	–	any	wordpress	5.5.3-1	wordpress-5.5.3-1-any.pkg.tar.zst

Source	Link
security	www.security.archlinux.org/AVG-1257
wordpress	www.wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
github	www.github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
github	www.github.com/WordPress/wordpress-develop/commit/e2142c20be3c07f7e5931014bca9a6e7f473479f
github	www.github.com/WordPress/wordpress-develop/commit/2d677cd4b2e24d0b5f17a3a278c719051bbe8e35
github	www.github.com/WordPress/wordpress-develop/commit/c9e6b98968025b1629015998d12c3102165a7d32
github	www.github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c
github	www.github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b7796842e6fb26315705ad
blog	www.blog.wpscan.com/2020/10/30/wordpress-5.5.2-security-release.html
github	www.github.com/WordPress/wordpress-develop/commit/69e832398254b7f47d137afaed40ff186015a71b

03 Nov 2020 00:00Current

2.1Low risk

Vulners AI Score2.1

CVSS 27.5

CVSS 3.19.8

EPSS0.16119