Authenticated self-XSS via theme uploads in WordPress(CVE-2020-4049)

概要

Authenticated self-XSS via theme uploads in WordPress

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami wordpress-multisite

[{"type":"SEMVER","events":[{"introduced":"3.7.0"},{"fixed":"3.7.34"},{"introduced":"3.8.0"},{"fixed":"3.8.34"},{"introduced":"3.9.0"},{"fixed":"3.9.32"},{"introduced":"4.0.0"},{"fixed":"4.0.31"},{"introduced":"4.1.0"},{"fixed":"4.1.31"},{"introduced":"4.2.0"},{"fixed":"4.2.28"},{"introduced":"4.3.0"},{"fixed":"4.3.24"},{"introduced":"4.4.0"},{"fixed":"4.4.23"},{"introduced":"4.5.0"},{"fixed":"4.5.22"},{"introduced":"4.6.0"},{"fixed":"4.6.19"},{"introduced":"4.7.0"},{"fixed":"4.7.18"},{"introduced":"4.8.0"},{"fixed":"4.8.14"},{"introduced":"4.9.0"},{"fixed":"4.9.15"},{"introduced":"5.0.0"},{"fixed":"5.0.10"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.7"},{"introduced":"5.3.0"},{"fixed":"5.3.4"},{"introduced":"5.4.0"},{"fixed":"5.4.2"}]}]

Bitnami wordpress

[{"type":"SEMVER","events":[{"introduced":"3.7.0"},{"fixed":"3.7.34"},{"introduced":"3.8.0"},{"fixed":"3.8.34"},{"introduced":"3.9.0"},{"fixed":"3.9.32"},{"introduced":"4.0.0"},{"fixed":"4.0.31"},{"introduced":"4.1.0"},{"fixed":"4.1.31"},{"introduced":"4.2.0"},{"fixed":"4.2.28"},{"introduced":"4.3.0"},{"fixed":"4.3.24"},{"introduced":"4.4.0"},{"fixed":"4.4.23"},{"introduced":"4.5.0"},{"fixed":"4.5.22"},{"introduced":"4.6.0"},{"fixed":"4.6.19"},{"introduced":"4.7.0"},{"fixed":"4.7.18"},{"introduced":"4.8.0"},{"fixed":"4.8.14"},{"introduced":"4.9.0"},{"fixed":"4.9.15"},{"introduced":"5.0.0"},{"fixed":"5.0.10"},{"introduced":"5.1.0"},{"fixed":"5.1.6"},{"introduced":"5.2.0"},{"fixed":"5.2.7"},{"introduced":"5.3.0"},{"fixed":"5.3.4"},{"introduced":"5.4.0"},{"fixed":"5.4.2"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2020-4049 wordpress 修正版: 5.4.2+dfsg1-1

概要

原文の説明

影響パッケージ

ディストリビューション別の修正状況

参照URL