3.5
Faible
CVE-2020-4050 In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta…
Description
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| wordpress-develop 5.4 | 5.4.0 → < 5.4.2 | 5.4.2 |
| wordpress-develop 5.3 | 5.3.0 → < 5.3.4 | 5.3.4 |
| wordpress-develop 5.2 | 5.2.0 → < 5.2.7 | 5.2.7 |
| wordpress-develop 5.1 | 5.1.0 → < 5.1.6 | 5.1.6 |
| wordpress-develop 5.0 | 5.0.0 → < 5.0.10 | 5.0.10 |
| wordpress-develop 4.9 | 4.9.0 → < 4.9.15 | 4.9.15 |
| wordpress-develop 4.8 | 4.8.0 → < 4.8.14 | 4.8.14 |
| wordpress-develop 4.7 | 4.7.0 → < 4.7.18 | 4.7.18 |
| wordpress-develop 4.6 | 4.6.0 → < 4.6.19 | 4.6.19 |
Afficher les 9 autres branches Masquer les 9 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| wordpress-develop 4.5 | 4.5.0 → < 4.5.22 | 4.5.22 |
| wordpress-develop 4.4 | 4.4.0 → < 4.4.23 | 4.4.23 |
| wordpress-develop 4.3 | 4.3.0 → < 4.3.24 | 4.3.24 |
| wordpress-develop 4.2 | 4.2.0 → < 4.2.28 | 4.2.28 |
| wordpress-develop 4.1 | 4.1.0 → < 4.1.31 | 4.1.31 |
| wordpress-develop 4.0 | 4.0.0 → < 4.0.31 | 4.0.31 |
| wordpress-develop 3.9 | 3.9.0 → < 3.9.32 | 3.9.32 |
| wordpress-develop 3.8 | 3.8.0 → < 3.8.34 | 3.8.34 |
| wordpress-develop 3.7 | 3.7.0 → < 3.7.34 | 3.7.34 |
Références
- wordpress.org wordpress.org
- github.com github.com
- github.com github.com
- FEDORA-2020-8447a3e195 lists.fedoraproject.org
- FEDORA-2020-bbedd29391 lists.fedoraproject.org
- DSA-4709 www.debian.org
- [debian-lts-announce] 20200701 [SECURITY] [DLA 2269-1] wordpress security update lists.debian.org
- [debian-lts-announce] 20200911 [SECURITY] [DLA 2371-1] wordpress security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de wordpress-develop
Les 17 CVE de wordpress-develop →
CVE-2024-31211
WordPress is an open publishing platform for the Web
5.5
Moyenne
CVE-2024-31210
WordPress is an open publishing platform for the Web
7.7
Élevée
CVE-2022-21662
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database
8.0
Élevée
CVE-2022-21663
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database
6.6
Moyenne