CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.2 | $0-$5k | 0.00 |
A vulnerability was found in WordPress (Content Management System) and classified as problematic. Affected by this issue is an unknown functionality of the file editor/wp-admin of the component Block Editor. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity. CVE summarizes:
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
The weakness was presented 06/12/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2020-4046 since 12/30/2019. The attack may be launched remotely. The successful exploitation needs a simple authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.
Upgrading to version 3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4 or 5.4.2 eliminates this vulnerability.
See 156672, 156671, 156670 and 156669 for similar entries.
Product
Type
Name
Version
- 3.7.0
- 3.7.1
- 3.7.2
- 3.7.3
- 3.7.4
- 3.7.5
- 3.7.6
- 3.7.7
- 3.7.8
- 3.7.9
- 3.7.10
- 3.7.11
- 3.7.12
- 3.7.13
- 3.7.14
- 3.7.15
- 3.7.16
- 3.7.17
- 3.7.18
- 3.7.19
- 3.7.20
- 3.7.21
- 3.7.22
- 3.7.23
- 3.7.24
- 3.7.25
- 3.7.26
- 3.7.27
- 3.7.28
- 3.7.29
- 3.7.30
- 3.7.31
- 3.7.32
- 3.7.33
- 3.8.0
- 3.8.1
- 3.8.2
- 3.8.3
- 3.8.4
- 3.8.5
- 3.8.6
- 3.8.7
- 3.8.8
- 3.8.9
- 3.8.10
- 3.8.11
- 3.8.12
- 3.8.13
- 3.8.14
- 3.8.15
- 3.8.16
- 3.8.17
- 3.8.18
- 3.8.19
- 3.8.20
- 3.8.21
- 3.8.22
- 3.8.23
- 3.8.24
- 3.8.25
- 3.8.26
- 3.8.27
- 3.8.28
- 3.8.29
- 3.8.30
- 3.8.31
- 3.8.32
- 3.8.33
- 3.9.0
- 3.9.1
- 3.9.2
- 3.9.3
- 3.9.4
- 3.9.5
- 3.9.6
- 3.9.7
- 3.9.8
- 3.9.9
- 3.9.10
- 3.9.11
- 3.9.12
- 3.9.13
- 3.9.14
- 3.9.15
- 3.9.16
- 3.9.17
- 3.9.18
- 3.9.19
- 3.9.20
- 3.9.21
- 3.9.22
- 3.9.23
- 3.9.24
- 3.9.25
- 3.9.26
- 3.9.27
- 3.9.28
- 3.9.29
- 3.9.30
- 3.9.31
- 4.0.0
- 4.0.1
- 4.0.2
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0.6
- 4.0.7
- 4.0.8
- 4.0.9
- 4.0.10
- 4.0.11
- 4.0.12
- 4.0.13
- 4.0.14
- 4.0.15
- 4.0.16
- 4.0.17
- 4.0.18
- 4.0.19
- 4.0.20
- 4.0.21
- 4.0.22
- 4.0.23
- 4.0.24
- 4.0.25
- 4.0.26
- 4.0.27
- 4.0.28
- 4.0.29
- 4.0.30
- 4.1
- 4.1 Beta1
- 4.1 Beta2
- 4.1 rc1
- 4.1 rc2
- 4.1 rc3
- 4.1.1
- 4.1.2
- 4.1.3
- 4.1.4
- 4.1.5
- 4.1.6
- 4.1.7
- 4.1.8
- 4.1.9
- 4.1.10
- 4.1.11
- 4.1.12
- 4.1.13
- 4.1.14
- 4.1.15
- 4.1.16
- 4.1.17
- 4.1.18
- 4.1.19
- 4.1.20
- 4.1.21
- 4.2
- 4.2 Beta1
- 4.2 Beta2
- 4.2 Beta3
- 4.2 Beta4
- 4.2 rc1
- 4.2 rc2
- 4.2 rc3
- 4.2 rc4
- 4.2.1
- 4.2.2
- 4.2.3
- 4.2.4
- 4.2.4 rc1
- 4.2.5
- 4.2.6
- 4.2.7
- 4.2.8
- 4.2.9
- 4.2.10
- 4.2.11
- 4.2.12
- 4.2.13
- 4.2.14
- 4.2.15
- 4.2.16
- 4.2.17
- 4.2.18
- 4.3
- 4.3 Beta1
- 4.3 Beta2
- 4.3 Beta3
- 4.3 Beta4
- 4.3 rc1
- 4.3 rc2
- 4.3 rc3
- 4.3.0
- 4.3.1
- 4.3.2
- 4.3.3
- 4.3.4
- 4.3.5
- 4.3.6
- 4.3.7
- 4.3.8
- 4.3.9
- 4.3.10
- 4.3.11
- 4.3.12
- 4.3.13
- 4.3.14
- 4.4
- 4.4 Beta1
- 4.4 Beta2
- 4.4 Beta3
- 4.4 Beta4
- 4.4 rc1
- 4.4.0
- 4.4.1
- 4.4.2
- 4.4.3
- 4.4.4
- 4.4.5
- 4.4.6
- 4.4.7
- 4.4.8
- 4.4.9
- 4.4.10
- 4.4.11
- 4.4.12
- 4.4.13
- 4.5
- 4.5 Beta1
- 4.5 Beta2
- 4.5 Beta3
- 4.5 Beta4
- 4.5 rc1
- 4.5 rc2
- 4.5 rc3
- 4.5.1
- 4.5.1 rc1
- 4.5.1 rc2
- 4.5.2
- 4.5.3
- 4.5.4
- 4.5.5
- 4.5.6
- 4.5.7
- 4.5.8
- 4.5.9
- 4.5.10
- 4.5.11
- 4.5.12
- 4.6.09
- 4.7.08
- 4.8.04
- 4.9.05
- 5.0
- 5.1.0
- 5.1.1
- 5.1.2
- 5.1.3
- 5.1.4
- 5.1.5
- 5.2.0
- 5.2.1
- 5.2.2
- 5.2.3
- 5.2.4
- 5.2.5
- 5.2.6
- 5.3.0
- 5.3.1
- 5.3.2
- 5.3.3
- 5.4.0
- 5.4.1
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.7VulDB Meta Temp Score: 4.5
VulDB Base Score: 4.1
VulDB Temp Score: 3.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.4
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-80 / CWE-74 / CWE-707
ATT&CK: T1059.007
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: WordPress 3.7.34/3.8.34/3.9.32/4.0.31/4.1.31/4.2.28/4.3.24/4.4.23/4.5.22/4.6.19/4.7.18/4.8.14/4.9.15/5.0.10/5.1.6/5.2.7/5.3.4/5.4.2
Timeline
12/30/2019 🔍06/12/2020 🔍
06/13/2020 🔍
10/24/2020 🔍
Sources
Product: wordpress.comAdvisory: github.com
Status: Not defined
Confirmation: 🔍
CVE: CVE-2020-4046 (🔍)
See also: 🔍
Entry
Created: 06/13/2020 07:40Updated: 10/24/2020 12:28
Changes: 06/13/2020 07:40 (40), 06/13/2020 07:45 (12), 10/24/2020 12:25 (1), 10/24/2020 12:28 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.