CVE-2018-20149

MEDIUM severity · CVSS 5.4 · Cross-site scripting (XSS)

5.4CVSS MEDIUM

Summary

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)4%

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

WordPress

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a ↗

Additional information

NVD record
https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19aPatch
https://codex.wordpress.org/Version_4.9.9Advisory
https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/Advisory
https://wordpress.org/support/wordpress-version/version-5-0-1/Advisory
https://wpvulndb.com/vulnerabilities/9175Advisory
http://www.securityfocus.com/bid/106220Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00019.htmlAdvisory
https://www.debian.org/security/2019/dsa-4401Advisory