CVE-2020-11027

EPSS 42.55%
Veröffentlicht 30.04.2020 23:15:11
Zuletzt bearbeitet 21.11.2024 04:56:37
Quelle security-advisories@github.com
CVE-Watchlists
Login
Unerledigt
Login

WordPress Core < 5.4.1 - Password Reset Link Non-Expiration

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Mögliche Gegenmaßnahme

WordPress: Update to one of the following versions, or a newer patched version: 3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

Betroffene Produkte Warnungen 0 Metriken 4 CWE 2 Referenzen 9

Weitere Schwachstelleninformationen

SystemWordPress Core

≫

Produkt WordPress

Version [*, 3.7)

Version 3.7 - 3.7.32

Version 3.8 - 3.8.32

Version 3.9 - 3.9.30

Version 4.0 - 4.0.29

Version 4.1 - 4.1.29

Version 4.2 - 4.2.26

Version 4.3 - 4.3.22

Version 4.4 - 4.4.21

Version 4.5 - 4.5.20

Version 4.6 - 4.6.17

Version 4.7 - 4.7.16

Version 4.8 - 4.8.12

Version 4.9 - 4.9.13

Version 5.0 - 5.0.8

Version 5.1 - 5.1.4

Version 5.2 - 5.2.5

Version 5.3 - 5.3.2

Version 5.4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Wordpress ≫ Wordpress Version >= 3.7 < 3.7.33

Wordpress ≫ Wordpress Version >= 3.8 < 3.8.33

Wordpress ≫ Wordpress Version >= 3.9 < 3.9.31

Wordpress ≫ Wordpress Version >= 4.0 < 4.0.30

Wordpress ≫ Wordpress Version >= 4.1 < 4.1.30

Wordpress ≫ Wordpress Version >= 4.2 < 4.2.27

Wordpress ≫ Wordpress Version >= 4.3 < 4.3.23

Wordpress ≫ Wordpress Version >= 4.4 < 4.4.22

Wordpress ≫ Wordpress Version >= 4.5 < 4.5.21

Wordpress ≫ Wordpress Version >= 4.6 < 4.6.18

Wordpress ≫ Wordpress Version >= 4.7 < 4.7.17

Wordpress ≫ Wordpress Version >= 4.8 < 4.8.13

Wordpress ≫ Wordpress Version >= 4.9 < 4.9.14

Wordpress ≫ Wordpress Version >= 5.0 < 5.0.9

Wordpress ≫ Wordpress Version >= 5.1 < 5.1.5

Wordpress ≫ Wordpress Version >= 5.2 < 5.2.6

Wordpress ≫ Wordpress Version >= 5.3 < 5.3.3

Wordpress ≫ Wordpress Version5.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	42.55%	0.973

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.1	2.8	5.2	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov	5.5	8	4.9	AV:N/AC:L/Au:S/C:P/I:P/A:N
security-advisories@github.com	6.1	1.6	4	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N