PT-2020-18340 · Unknown · Buddypress

Ehti · Published 2020-02-24 · Updated 2020-02-25 · CVE-2020-5244

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions BuddyPress versions prior to 5.1.2

Description The issue allows requests to a certain REST API endpoint to expose private user data without requiring authentication.

Recommendations For versions prior to 5.1.2, update to version 5.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST API endpoint until the update is applied.

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2020-5244

GHSA-3J78-7M59-R7GV

Affected Products

Buddypress

References · 7

• https://github.com/buddypress/BuddyPress/commit/39294680369a0c992290577a9d740f4a2f2c2ca3 · Patch
• https://buddypress.org/2020/01/buddypress-5-1-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5244 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5244 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j78-7m59-r7gv · Vendor Advisory
• https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gv · Note
• https://t.me/cvenotify/1180 · Telegram Post