CVE-2018-20147

Published: Dec 14, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.

Affected (4)

Products: Wordpress: Wordpress · Debian: Debian Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Before 4.9.9
Wordpress Wordpress	From 5.0 to 5.0.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (16)

http://www.securityfocus.com/bid/106220

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://codex.wordpress.org/Version_4.9.9

Source: cve@mitre.org

ProductVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/

Source: cve@mitre.org

Release NotesVendor Advisory

https://wordpress.org/support/wordpress-version/version-5-0-1/

Source: cve@mitre.org

ProductVendor Advisory

https://wpvulndb.com/vulnerabilities/9169

Source: cve@mitre.org

Vendor Advisory

https://www.debian.org/security/2019/dsa-4401

Source: cve@mitre.org

Third Party Advisory

https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/

Source: cve@mitre.org

Press/Media CoverageThird Party Advisory

http://www.securityfocus.com/bid/106220