CVE-2020-11029 - Vulnerability Details

Vendors	Products
Debian	Debian Linux
Wordpress	Wordpress

Link	Providers
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c
https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html
https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates
https://www.debian.org/security/2020/dsa-4677

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "WordPress", "vendor": "WordPress", "versions": [{"status": "affected", "version": ">= 5.4.0, < 5.4.1"}, {"status": "affected", "version": ">= 5.3.0, < 5.3.3"}, {"status": "affected", "version": ">= 5.2.0, < 5.2.6"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.5"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.9"}, {"status": "affected", "version": ">= 4.9.0, < 4.9.14"}, {"status": "affected", "version": ">= 4.8.0, < 4.8.13"}, {"status": "affected", "version": ">= 4.7.0, < 4.7.17"}, {"status": "affected", "version": ">= 4.6.0, < 4.6.18"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.21"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.22"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.23"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.27"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.30"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.30"}, {"status": "affected", "version": ">= 3.9.0, < 3.9.31"}, {"status": "affected", "version": ">= 3.8.0, < 3.8.33"}, {"status": "affected", "version": ">= 3.7.0, < 3.7.33"}]}], "descriptions": [{"lang": "en", "value": "In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-05-11T15:06:04", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c"}, {"name": "DSA-4677", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2020/dsa-4677"}, {"name": "[debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"}], "source": {"advisory": "GHSA-568w-8m88-8g2c", "discovery": "UNKNOWN"}, "title": "Cross-site scripting in stats method (object cache) in WordPress", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-11029", "STATE": "PUBLIC", "TITLE": "Cross-site scripting in stats method (object cache) in WordPress"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WordPress", "version": {"version_data": [{"version_value": ">= 5.4.0, < 5.4.1"}, {"version_value": ">= 5.3.0, < 5.3.3"}, {"version_value": ">= 5.2.0, < 5.2.6"}, {"version_value": ">= 5.1.0, < 5.1.5"}, {"version_value": ">= 5.0.0, < 5.0.9"}, {"version_value": ">= 4.9.0, < 4.9.14"}, {"version_value": ">= 4.8.0, < 4.8.13"}, {"version_value": ">= 4.7.0, < 4.7.17"}, {"version_value": ">= 4.6.0, < 4.6.18"}, {"version_value": ">= 4.5.0, < 4.5.21"}, {"version_value": ">= 4.4.0, < 4.4.22"}, {"version_value": ">= 4.3.0, < 4.3.23"}, {"version_value": ">= 4.2.0, < 4.2.27"}, {"version_value": ">= 4.1.0, < 4.1.30"}, {"version_value": ">= 4.0.0, < 4.0.30"}, {"version_value": ">= 3.9.0, < 3.9.31"}, {"version_value": ">= 3.8.0, < 3.8.33"}, {"version_value": ">= 3.7.0, < 3.7.33"}]}}]}, "vendor_name": "WordPress"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates", "refsource": "MISC", "url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates"}, {"name": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c", "refsource": "CONFIRM", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c"}, {"name": "DSA-4677", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2020/dsa-4677"}, {"name": "[debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"}]}, "source": {"advisory": "GHSA-568w-8m88-8g2c", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:21:14.187Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c"}, {"name": "DSA-4677", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2020/dsa-4677"}, {"name": "[debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11029", "datePublished": "2020-04-30T22:15:18", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2024-08-04T11:21:14.187Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : WordPress (string)

vendor : WordPress (string)

versions : [ »

0 : { »

status : affected (string)

version : >= 5.4.0, < 5.4.1 (string)

}

1 : { »

status : affected (string)

version : >= 5.3.0, < 5.3.3 (string)

}

2 : { »

status : affected (string)

version : >= 5.2.0, < 5.2.6 (string)

}

3 : { »

status : affected (string)

version : >= 5.1.0, < 5.1.5 (string)

}

4 : { »

status : affected (string)

version : >= 5.0.0, < 5.0.9 (string)

}

5 : { »

status : affected (string)

version : >= 4.9.0, < 4.9.14 (string)

}

6 : { »

status : affected (string)

version : >= 4.8.0, < 4.8.13 (string)

}

7 : { »

status : affected (string)

version : >= 4.7.0, < 4.7.17 (string)

}

8 : { »

status : affected (string)

version : >= 4.6.0, < 4.6.18 (string)

}

9 : { »

status : affected (string)

version : >= 4.5.0, < 4.5.21 (string)

}

10 : { »

status : affected (string)

version : >= 4.4.0, < 4.4.22 (string)

}

11 : { »

status : affected (string)

version : >= 4.3.0, < 4.3.23 (string)

}

12 : { »

status : affected (string)

version : >= 4.2.0, < 4.2.27 (string)

}

13 : { »

status : affected (string)

version : >= 4.1.0, < 4.1.30 (string)

}

14 : { »

status : affected (string)

version : >= 4.0.0, < 4.0.30 (string)

}

15 : { »

status : affected (string)

version : >= 3.9.0, < 3.9.31 (string)

}

16 : { »

status : affected (string)

version : >= 3.8.0, < 3.8.33 (string)

}

17 : { »

status : affected (string)

version : >= 3.7.0, < 3.7.33 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-05-11T15:06:04 (string)

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

}

2 : { »

name : DSA-4677 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_DEBIAN (string)

]

url : https://www.debian.org/security/2020/dsa-4677 (string)

}

3 : { »

name : [debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html (string)

}

]

source : { »

advisory : GHSA-568w-8m88-8g2c (string)

discovery : UNKNOWN (string)

}

title : Cross-site scripting in stats method (object cache) in WordPress (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security-advisories@github.com (string)

ID : CVE-2020-11029 (string)

STATE : PUBLIC (string)

TITLE : Cross-site scripting in stats method (object cache) in WordPress (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : WordPress (string)

version : { »

version_data : [ »

0 : { »

version_value : >= 5.4.0, < 5.4.1 (string)

}

1 : { »

version_value : >= 5.3.0, < 5.3.3 (string)

}

2 : { »

version_value : >= 5.2.0, < 5.2.6 (string)

}

3 : { »

version_value : >= 5.1.0, < 5.1.5 (string)

}

4 : { »

version_value : >= 5.0.0, < 5.0.9 (string)

}

5 : { »

version_value : >= 4.9.0, < 4.9.14 (string)

}

6 : { »

version_value : >= 4.8.0, < 4.8.13 (string)

}

7 : { »

version_value : >= 4.7.0, < 4.7.17 (string)

}

8 : { »

version_value : >= 4.6.0, < 4.6.18 (string)

}

9 : { »

version_value : >= 4.5.0, < 4.5.21 (string)

}

10 : { »

version_value : >= 4.4.0, < 4.4.22 (string)

}

11 : { »

version_value : >= 4.3.0, < 4.3.23 (string)

}

12 : { »

version_value : >= 4.2.0, < 4.2.27 (string)

}

13 : { »

version_value : >= 4.1.0, < 4.1.30 (string)

}

14 : { »

version_value : >= 4.0.0, < 4.0.30 (string)

}

15 : { »

version_value : >= 3.9.0, < 3.9.31 (string)

}

16 : { »

version_value : >= 3.8.0, < 3.8.33 (string)

}

17 : { »

version_value : >= 3.7.0, < 3.7.33 (string)

}

]

}

]

}

vendor_name : WordPress (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). (string)

}

]

}

impact : { »

cvss : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N (string)

version : 3.1 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

refsource : MISC (string)

url : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

}

1 : { »

name : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

refsource : CONFIRM (string)

url : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

}

2 : { »

name : DSA-4677 (string)

refsource : DEBIAN (string)

url : https://www.debian.org/security/2020/dsa-4677 (string)

}

3 : { »

name : [debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update (string)

refsource : MLIST (string)

url : https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html (string)

}

]

}

source : { »

advisory : GHSA-568w-8m88-8g2c (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T11:21:14.187Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

}

2 : { »

name : DSA-4677 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_DEBIAN (string)

2 : x_transferred (string)

]

url : https://www.debian.org/security/2020/dsa-4677 (string)

}

3 : { »

name : [debian-lts-announce] 20200511 [SECURITY] [DLA 2208-1] wordpress security update (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

assignerShortName : GitHub_M (string)

cveId : CVE-2020-11029 (string)

datePublished : 2020-04-30T22:15:18 (string)

dateReserved : 2020-03-30T00:00:00 (string)

dateUpdated : 2024-08-04T11:21:14.187Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFDCD9BA-05B3-4EE5-ABE7-A6DF77F1DEB4", "versionEndExcluding": "3.7.33", "versionStartIncluding": "3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BE6D23B-B8DA-4013-812D-329D765729B3", "versionEndExcluding": "3.8.33", "versionStartIncluding": "3.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "B249947E-34C8-4319-A756-3095210C86BE", "versionEndExcluding": "3.9.31", "versionStartIncluding": "3.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "222FACD8-E13D-43F0-9EB8-D3837534BE61", "versionEndExcluding": "4.0.30", "versionStartIncluding": "4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F37A9AE-0368-46E5-9163-0E77860D967E", "versionEndExcluding": "4.1.30", "versionStartIncluding": "4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC97B598-CD50-4501-8368-97160D885596", "versionEndExcluding": "4.2.27", "versionStartIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "E071B431-86C3-4DD0-B7D6-7581E53E4398", "versionEndExcluding": "4.3.23", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "65D50EA1-08F5-4F17-B47D-2CABE77B7101", "versionEndExcluding": "4.4.22", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE8BFCAE-36A9-4017-B484-766AA82A517B", "versionEndExcluding": "4.5.21", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A44AAFC-3FB1-4FB9-BBE9-6FB8E553AC55", "versionEndExcluding": "4.6.18", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C2F3EB4-8D53-4E73-99CB-6D4DB18862CB", "versionEndExcluding": "4.7.17", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A2168FB-94B6-4B89-A205-B8806668C56C", "versionEndExcluding": "4.8.13", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6B09641-582C-4BC9-B0A8-976CC4CB2F9C", "versionEndExcluding": "4.9.14", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "29C2D12B-4F1B-4473-A23B-C923FA1EF442", "versionEndExcluding": "5.0.9", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E6ACD77-B8AA-40ED-8F43-F7AE245556FE", "versionEndExcluding": "5.1.5", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AA6DEC1-5040-4D00-9A01-F2C0A2D071D3", "versionEndExcluding": "5.2.6", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1FA1821-19B3-482D-BCA1-3F2E22A7B603", "versionEndExcluding": "5.3.3", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:5.4:*:*:*:*:*:*:*", "matchCriteriaId": "46EA68C0-B847-447C-BB19-1C440F0A761D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."}, {"lang": "es", "value": "En las versiones afectadas de WordPress, una vulnerabilidad en el m\u00e9todo stats() del archivo class-wp-object-cache.php puede ser explotada para ejecutar un ataque de tipo cross-site scripting (XSS). Esto ha sido corregido en la versi\u00f3n 5.4.1, junto con todas las versiones afectadas anteriormente mediante una versi\u00f3n menor (versiones 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33)."}], "id": "CVE-2020-11029", "lastModified": "2024-11-21T04:56:37.500", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-30T23:15:11.747", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2020/dsa-4677"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2020/dsa-4677"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* (string)

matchCriteriaId : C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* (string)

matchCriteriaId : DEECE5FC-CACF-4496-A3E7-164736409252 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 07B237A9-69A3-4A9C-9DA0-4E06BD37AE73 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AFDCD9BA-05B3-4EE5-ABE7-A6DF77F1DEB4 (string)

versionEndExcluding : 3.7.33 (string)

versionStartIncluding : 3.7 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8BE6D23B-B8DA-4013-812D-329D765729B3 (string)

versionEndExcluding : 3.8.33 (string)

versionStartIncluding : 3.8 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B249947E-34C8-4319-A756-3095210C86BE (string)

versionEndExcluding : 3.9.31 (string)

versionStartIncluding : 3.9 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 222FACD8-E13D-43F0-9EB8-D3837534BE61 (string)

versionEndExcluding : 4.0.30 (string)

versionStartIncluding : 4.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4F37A9AE-0368-46E5-9163-0E77860D967E (string)

versionEndExcluding : 4.1.30 (string)

versionStartIncluding : 4.1 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FC97B598-CD50-4501-8368-97160D885596 (string)

versionEndExcluding : 4.2.27 (string)

versionStartIncluding : 4.2 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E071B431-86C3-4DD0-B7D6-7581E53E4398 (string)

versionEndExcluding : 4.3.23 (string)

versionStartIncluding : 4.3 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 65D50EA1-08F5-4F17-B47D-2CABE77B7101 (string)

versionEndExcluding : 4.4.22 (string)

versionStartIncluding : 4.4 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : EE8BFCAE-36A9-4017-B484-766AA82A517B (string)

versionEndExcluding : 4.5.21 (string)

versionStartIncluding : 4.5 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 0A44AAFC-3FB1-4FB9-BBE9-6FB8E553AC55 (string)

versionEndExcluding : 4.6.18 (string)

versionStartIncluding : 4.6 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1C2F3EB4-8D53-4E73-99CB-6D4DB18862CB (string)

versionEndExcluding : 4.7.17 (string)

versionStartIncluding : 4.7 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4A2168FB-94B6-4B89-A205-B8806668C56C (string)

versionEndExcluding : 4.8.13 (string)

versionStartIncluding : 4.8 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D6B09641-582C-4BC9-B0A8-976CC4CB2F9C (string)

versionEndExcluding : 4.9.14 (string)

versionStartIncluding : 4.9 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 29C2D12B-4F1B-4473-A23B-C923FA1EF442 (string)

versionEndExcluding : 5.0.9 (string)

versionStartIncluding : 5.0 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E6ACD77-B8AA-40ED-8F43-F7AE245556FE (string)

versionEndExcluding : 5.1.5 (string)

versionStartIncluding : 5.1 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 0AA6DEC1-5040-4D00-9A01-F2C0A2D071D3 (string)

versionEndExcluding : 5.2.6 (string)

versionStartIncluding : 5.2 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E1FA1821-19B3-482D-BCA1-3F2E22A7B603 (string)

versionEndExcluding : 5.3.3 (string)

versionStartIncluding : 5.3 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:wordpress:wordpress:5.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 46EA68C0-B847-447C-BB19-1C440F0A761D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). (string)

}

1 : { »

lang : es (string)

value : En las versiones afectadas de WordPress, una vulnerabilidad en el método stats() del archivo class-wp-object-cache.php puede ser explotada para ejecutar un ataque de tipo cross-site scripting (XSS). Esto ha sido corregido en la versión 5.4.1, junto con todas las versiones afectadas anteriormente mediante una versión menor (versiones 5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). (string)

}

]

id : CVE-2020-11029 (string)

lastModified : 2024-11-21T04:56:37.500 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.3 (number)

impactScore : 4 (number)

source : security-advisories@github.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-04-30T23:15:11.747 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

}

1 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html (string)

}

2 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Release Notes (string)

1 : Vendor Advisory (string)

]

url : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

}

3 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.debian.org/security/2020/dsa-4677 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-568w-8m88-8g2c (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Release Notes (string)

1 : Vendor Advisory (string)

]

url : https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://www.debian.org/security/2020/dsa-4677 (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : security-advisories@github.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object