Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

debian логотип

CVE-2023-5561

Опубликовано: 16 окт. 2023
Источник: debian
EPSS Средний

Описание

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Пакеты

ПакетСтатусВерсия исправленияРелизТип
wordpressfixed6.3.2+dfsg1-1package

Примечания

  • https://wordpress.org/documentation/wordpress-version/version-6-3-2/

  • https://core.trac.wordpress.org/changeset/56840/

EPSS

Процентиль: 98%
0.60926
Средний

Связанные уязвимости

CVSS3: 5.3
ubuntu
почти 2 года назад

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

CVSS3: 5.3
nvd
почти 2 года назад

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

CVSS3: 5.3
github
почти 2 года назад

The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS3: 5.3
fstec
почти 2 года назад

Уязвимость реализации прикладного программного интерфейса системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 98%
0.60926
Средний