CVE-2019-20042
MEDIUM
6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
MEDIUM
4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none
Description
AI Translation Available
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0505
Percentile
0,9th
Updated
EPSS Score Trend (Last 90 Days)
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
Operating System
Debian Linux by Debian
CPE Identifier
View Detailed Analysis
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Wordpress by Wordpress
Version Range Affected
From
3.7
(inclusive)
To
5.3.1
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Debian Linux by Debian
CPE Identifier
View Detailed Analysis
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://blog.ripstech.com/filter/vulnerabilities/
https://core.trac.wordpress.org/changeset/46894/trunk
https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd…
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2…
https://hackerone.com/reports/509930
https://seclists.org/bugtraq/2020/Jan/8
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-rel…
https://wpvulndb.com/vulnerabilities/9975
https://www.debian.org/security/2020/dsa-4599
https://www.debian.org/security/2020/dsa-4677
https://blog.ripstech.com/filter/vulnerabilities/
https://core.trac.wordpress.org/changeset/46894/trunk
https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd…
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2…
https://hackerone.com/reports/509930
https://seclists.org/bugtraq/2020/Jan/8
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-rel…
https://wpvulndb.com/vulnerabilities/9975
https://www.debian.org/security/2020/dsa-4599
https://www.debian.org/security/2020/dsa-4677