PT-2020-3637 · WordPress · Wordpress

Jazzy2Fives + 1 · Published 2020-06-12 · Updated 2024-03-06 · CVE-2020-4048

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.4.2 WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34

Description The issue is related to an unintended/open redirect when an arbitrary external link is crafted due to a problem in wp validate redirect() and URL sanitization. This could allow a remote attacker to access and compromise confidential data.

Recommendations For WordPress versions prior to 5.4.2, update to version 5.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to external links until the update is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2020-03985

BIT-WORDPRESS-2020-4048

BIT-WORDPRESS-MULTISITE-2020-4048

CVE-2020-4048

DLA-2269-1

DLA-2371-1

DSA-4709-1

GHSA-Q6PW-GVF4-5FJ5

Affected Products

Wordpress

References · 25

• https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357 · Vendor Advisory
• https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-4048 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-4048 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-4048 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN · Vendor Advisory
• https://debian.org/security/2020/dsa-4709 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03985 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-2020-4048 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4048 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4709-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2020-4048 · Vendor Advisory