Количество 5
Количество 5
CVE-2019-20043
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
CVE-2019-20043
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
CVE-2019-20043
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.ph ...
GHSA-ppxh-5qq2-77g8
WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.
BDU:2020-01953
Уязвимость функции class-wp-rest-posts-controller системы управления содержимым сайта WordPress, связанная с небезопасным управлением привилегиями, позволяющая нарушителю оказать воздействие на целостность данных
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2019-20043 In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | CVSS3: 4.3 | 1% Низкий | больше 5 лет назад |
 | CVE-2019-20043 In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | CVSS3: 4.3 | 1% Низкий | больше 5 лет назад |
| CVE-2019-20043 In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.ph ... | CVSS3: 4.3 | 1% Низкий | больше 5 лет назад |
| GHSA-ppxh-5qq2-77g8 WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php. | CVSS3: 4.3 | 1% Низкий | около 3 лет назад |
 | BDU:2020-01953 Уязвимость функции class-wp-rest-posts-controller системы управления содержимым сайта WordPress, связанная с небезопасным управлением привилегиями, позволяющая нарушителю оказать воздействие на целостность данных | CVSS3: 5.3 | 1% Низкий | почти 6 лет назад |
Уязвимостей на страницу