CVE-2022-4973
WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
Résumé
WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
Description d'origine
La description telle que publiée par la source (souvent en anglais).
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
Paquets affectés
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.2"},{"introduced":"3.7.0"},{"fixed":"3.7.39"},{"introduced":"3.8.0"},{"fixed":"3.8.39"},{"introduced":"3.9.0"},{"fixed":"3.9.37"},{"introduced":"4.0.0"},{"fixed":"4.0.36"},{"introduced":"4.1.0"},{"fixed":"4.1.36"},{"introduced":"4.2.0"},{"fixed":"4.2.33"},{"introduced":"4.3.0"},{"fixed":"4.3.29"},{"introduced":"4.4.0"},{"fixed":"4.4.28"},{"introduced":"4.5.0"},{"fixed":"4.5.27"},{"introduced":"4.6.0"},{"fixed":"4.6.24"},{"introduced":"4.7.0"},{"fixed":"4.7.24"},{"introduced":"4.8.0"},{"fixed":"4.8.20"},{"introduced":"4.9.0"},{"fixed":"4.9.21"},{"introduced":"5.0.0"},{"fixed":"5.0.17"},{"introduced":"5.1.0"},{"fixed":"5.1.14"},{"introduced":"5.2.0"},{"fixed":"5.2.16"},{"introduced":"5.3.0"},{"fixed":"5.3.13"},{"introduced":"5.4.0"},{"fixed":"5.4.11"},{"introduced":"5.5.0"},{"fixed":"5.5.10"},{"introduced":"5.6.0"},{"fixed":"5.6.9"},{"introduced":"5.7.0"},{"fixed":"5.7.7"},{"introduced":"5.8.0"},{"fixed":"5.8.5"},{"introduced":"5.9.0"},{"fixed":"5.9.4"},{"introduced":"6.0.0"},{"fixed":"6.0.2"}]}]
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.2"},{"introduced":"3.7.0"},{"fixed":"3.7.39"},{"introduced":"3.8.0"},{"fixed":"3.8.39"},{"introduced":"3.9.0"},{"fixed":"3.9.37"},{"introduced":"4.0.0"},{"fixed":"4.0.36"},{"introduced":"4.1.0"},{"fixed":"4.1.36"},{"introduced":"4.2.0"},{"fixed":"4.2.33"},{"introduced":"4.3.0"},{"fixed":"4.3.29"},{"introduced":"4.4.0"},{"fixed":"4.4.28"},{"introduced":"4.5.0"},{"fixed":"4.5.27"},{"introduced":"4.6.0"},{"fixed":"4.6.24"},{"introduced":"4.7.0"},{"fixed":"4.7.24"},{"introduced":"4.8.0"},{"fixed":"4.8.20"},{"introduced":"4.9.0"},{"fixed":"4.9.21"},{"introduced":"5.0.0"},{"fixed":"5.0.17"},{"introduced":"5.1.0"},{"fixed":"5.1.14"},{"introduced":"5.2.0"},{"fixed":"5.2.16"},{"introduced":"5.3.0"},{"fixed":"5.3.13"},{"introduced":"5.4.0"},{"fixed":"5.4.11"},{"introduced":"5.5.0"},{"fixed":"5.5.10"},{"introduced":"5.6.0"},{"fixed":"5.6.9"},{"introduced":"5.7.0"},{"fixed":"5.7.7"},{"introduced":"5.8.0"},{"fixed":"5.8.5"},{"introduced":"5.9.0"},{"fixed":"5.9.4"},{"introduced":"6.0.0"},{"fixed":"6.0.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-4973 wordpress Corrigé dans: 5.7.8+dfsg1-0+deb11u1
Références
- advisory wordfence.com
- advisory wordfence.com
- patch core.trac.wordpress.org
- web wordpress.org
- web nvd.nist.gov