WordPress Authenticated disclosure of password-protected pos…(CVE-2021-29450)

概要

WordPress Authenticated disclosure of password-protected posts and pages

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami wordpress

[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"5.7.1"}]}]

Bitnami wordpress-multisite

[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"5.7.1"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2021-29450 wordpress 修正版: 5.7.1+dfsg1-1
Ubuntu UBUNTU-CVE-2021-29450 wordpress

参照URL

advisory github.com
advisory lists.debian.org
advisory wordpress.org
advisory debian.org
web nvd.nist.gov