CVE-2020-4049

Published: 12 June 2020

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Priority

Cvss 3 Severity Score

2.4

Score breakdown

Status

Package	Release	Status
wordpress Launchpad, Ubuntu, Debian	bionic	Needs triage
	eoan	Ignored (end of life)
	focal	Needs triage
	groovy	Ignored (end of life)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needs triage
	kinetic	Ignored (end of life, was needs-triage)
	lunar	Not vulnerable (6.0+dfsg1-1ubuntu1)
	mantic	Not vulnerable (6.0+dfsg1-1ubuntu1)
	trusty	Does not exist
	upstream	Released (5.4.2+dfsg1-1)
	xenial	Needs triage

Severity score breakdown

Parameter	Value
Base score	2.4
Attack vector	Network
Attack complexity	Low
Privileges required	High
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962685

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›