CVE-2020-28039

Опубликовано: 02 нояб. 2020

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.

Ссылки

https://github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b7796842e6fb26315705ad
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Release Notes
Vendor Advisory
https://wpscan.com/vulnerability/10452
Third Party Advisory
https://www.debian.org/security/2020/dsa-4784
Third Party Advisory
https://github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b7796842e6fb26315705ad
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXVUAKL2HL4QYJEPHBNVQQWRMFMII2Y/
https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/
Release Notes
Vendor Advisory
https://wpscan.com/vulnerability/10452
Third Party Advisory
https://www.debian.org/security/2020/dsa-4784
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

Версия до 5.5.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 90%

0.05996

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2020-28039

CVSS3: 9.1

ubuntu

больше 4 лет назад

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.

CVE-2020-28039

CVSS3: 9.1

debian

больше 4 лет назад

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 al ...

GHSA-65h5-8qpr-9m3v

CVSS3: 9.1

github

около 3 лет назад

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.

BDU:2021-01736

CVSS3: 9.1

fstec

больше 4 лет назад

Уязвимость функции is_protected_meta компонента wp-includes/meta.php системы управления содержимым сайта WordPress, связанная с неправильным контролем доступа, позволяющая нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании

EPSS

Процентиль: 90%

0.05996

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

NVD-CWE-noinfo