The vulnerability of the WordPress website content management system allows for bypassing authentication processes through alternative pathways or channels. This enables attackers to access sensitive data, compromise its integrity, and cause service interruptions.

🗓️ 19 Aug 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

WordPress authentication bypass via an alternate path exposes data and disrupts service.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in the IBM HTTP Server and IBM WebSphere Application Server used in IBM WebSphere Application Server in IBM Cloud	16 Jun 202013:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server bundled with IBM WebSphere Application Server Patterns	5 Jun 202018:40	–	ibm
BDU FSTEC	The vulnerability of the WordPress website content management system lies in the lack of measures to eliminate script-related HTML tags on web pages, allowing attackers to compromise data integrity.	19 Aug 202000:00	–	bdu_fstec
CVE	CVE-2020-4049	12 Jun 202016:00	–	cve
Cvelist	CVE-2020-4049 Authenticated self-XSS via theme uploads in WordPress	12 Jun 202016:00	–	cvelist
Debian	[SECURITY] [DLA 2269-1] wordpress security update	1 Jul 202012:23	–	debian
Debian	[SECURITY] [DLA 2371-1] wordpress security update	11 Sep 202014:42	–	debian
Debian	[SECURITY] [DSA 4709-1] wordpress security update	23 Jun 202014:17	–	debian
Debian	[SECURITY] [DSA 4709-1] wordpress security update	23 Jun 202014:17	–	debian
Debian CVE	CVE-2020-4049	12 Jun 202016:00	–	debiancve

Vulners

Node

wordpress wordpressRange3.7–3.7.34

OR

wordpress wordpressRange3.8–3.8.34

OR

wordpress wordpressRange3.9–3.9.32

OR

wordpress wordpressRange4.0–4.0.31

OR

wordpress wordpressRange4.1–4.1.31

OR

wordpress wordpressRange4.2–4.2.28

OR

wordpress wordpressRange4.3–4.3.24

OR

wordpress wordpressRange4.4–4.4.23

OR

wordpress wordpressRange4.5–4.5.22

OR

wordpress wordpressRange4.6–4.6.19

OR

wordpress wordpressRange4.7–4.7.18

OR

wordpress wordpressRange4.8–4.8.14

OR

wordpress wordpressRange4.9–4.9.15

OR

wordpress wordpressRange5.0–5.0.10

OR

wordpress wordpressRange5.1–5.1.6

OR

wordpress wordpressRange5.2–5.2.7

OR

wordpress wordpressRange5.3–5.3.4

OR

wordpress wordpressRange5.4–5.4.2

OR

fedora fedoraMatch31

OR

fedora fedoraMatch32

Source	Link
wordpress	www.wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-4050
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-4050
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/
web	www.web.nvd.nist.gov/view/vuln/detail

19 Aug 2020 00:00Current

6Medium risk

Vulners AI Score6

CVSS 37.5

CVSS 28.5

EPSS0.02805

WordPress authentication bypass alternate path sensitive data data integrity service disruption