PT-2019-5223 · WordPress · Wordpress

Published 2019-09-11 · Updated 2023-01-19 · CVE-2019-20042

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7 through 5.3.0

Description The issue is related to the wp targeted link rel() function in WordPress, which can be exploited to result in a stored cross-site scripting (XSS) vulnerability. This vulnerability can be used by a remote attacker to impact data integrity. The vulnerability has been patched in WordPress 5.3.1 and all previous versions from 3.7 to 5.3 via a minor release.

Recommendations For WordPress versions 3.7 through 5.3.0, update to WordPress 5.3.1 or a later version to resolve the issue. As a temporary workaround, consider disabling the wp targeted link rel() function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01952

CVE-2019-20042

DSA-4599-1

DSA-4677-1

GHSA-XVG2-M2F4-83M7

Affected Products

Wordpress

References · 21

• https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20042 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20042 · Security Note
• https://debian.org/security/2020/dsa-4599 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20042 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20042 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4599-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4677-1 · Vendor Advisory
• https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20042 · Security Note
• https://ubuntu.com/security/CVE-2019-20042 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01952 · Security Note
• https://core.trac.wordpress.org/changeset/46894/trunk · Patch
• https://debian.org/security/2020/dsa-4677 · Vendor Advisory