Lucene search

K
cve[email protected]CVE-2020-11027
HistoryApr 30, 2020 - 11:15 p.m.

CVE-2020-11027

2020-04-3023:15:11
CWE-640
CWE-672
web.nvd.nist.gov
164
2
wordpress
password reset
vulnerability
cve-2020-11027
nvd
security fix

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.7%

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Affected configurations

Vulners
NVD
Node
wordpresswordpressRange5.4.05.4.1
OR
wordpresswordpressRange5.3.05.3.3
OR
wordpresswordpressRange5.2.05.2.6
OR
wordpresswordpressRange5.1.05.1.5
OR
wordpresswordpressRange5.0.05.0.9
OR
wordpresswordpressRange4.9.04.9.14
OR
wordpresswordpressRange4.8.04.8.13
OR
wordpresswordpressRange4.7.04.7.17
OR
wordpresswordpressRange4.6.04.6.18
OR
wordpresswordpressRange4.5.04.5.21
OR
wordpresswordpressRange4.4.04.4.22
OR
wordpresswordpressRange4.3.04.3.23
OR
wordpresswordpressRange4.2.04.2.27
OR
wordpresswordpressRange4.1.04.1.30
OR
wordpresswordpressRange4.0.04.0.30
OR
wordpresswordpressRange3.9.03.9.31
OR
wordpresswordpressRange3.8.03.8.33
OR
wordpresswordpressRange3.7.03.7.33
VendorProductVersionCPE
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Rows per page:
1-10 of 181

CNA Affected

[
  {
    "vendor": "WordPress",
    "product": "WordPress",
    "versions": [
      {
        "version": ">= 5.4.0, < 5.4.1",
        "status": "affected"
      },
      {
        "version": ">= 5.3.0, < 5.3.3",
        "status": "affected"
      },
      {
        "version": ">= 5.2.0, < 5.2.6",
        "status": "affected"
      },
      {
        "version": ">= 5.1.0, < 5.1.5",
        "status": "affected"
      },
      {
        "version": ">= 5.0.0, < 5.0.9",
        "status": "affected"
      },
      {
        "version": ">= 4.9.0, < 4.9.14",
        "status": "affected"
      },
      {
        "version": ">= 4.8.0, < 4.8.13",
        "status": "affected"
      },
      {
        "version": ">= 4.7.0, < 4.7.17",
        "status": "affected"
      },
      {
        "version": ">= 4.6.0, < 4.6.18",
        "status": "affected"
      },
      {
        "version": ">= 4.5.0, < 4.5.21",
        "status": "affected"
      },
      {
        "version": ">= 4.4.0, < 4.4.22",
        "status": "affected"
      },
      {
        "version": ">= 4.3.0, < 4.3.23",
        "status": "affected"
      },
      {
        "version": ">= 4.2.0, < 4.2.27",
        "status": "affected"
      },
      {
        "version": ">= 4.1.0, < 4.1.30",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.0.30",
        "status": "affected"
      },
      {
        "version": ">= 3.9.0, < 3.9.31",
        "status": "affected"
      },
      {
        "version": ">= 3.8.0, < 3.8.33",
        "status": "affected"
      },
      {
        "version": ">= 3.7.0, < 3.7.33",
        "status": "affected"
      }
    ]
  }
]

Social References

More

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.7%