CVE-2023-5561
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Résumé
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Description d'origine
La description telle que publiée par la source (souvent en anglais).
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Paquets affectés
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.7.27"},{"introduced":"4.8.0"},{"fixed":"4.8.23"},{"introduced":"4.9.0"},{"fixed":"4.9.24"},{"introduced":"5.0.0"},{"fixed":"5.0.20"},{"introduced":"5.1.0"},{"fixed":"5.1.17"},{"introduced":"5.2.0"},{"fixed":"5.2.19"},{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"5.4.0"},{"fixed":"5.4.14"},{"introduced":"5.5.0"},{"fixed":"5.5.13"},{"introduced":"5.6.0"},{"fixed":"5.6.12"},{"introduced":"5.7.0"},{"fixed":"5.7.10"},{"introduced":"5.8.0"},{"fixed":"5.8.8"},{"introduced":"5.9.0"},{"fixed":"5.9.8"},{"introduced":"6.0.0"},{"fixed":"6.0.6"},{"introduced":"6.1.0"},{"fixed":"6.1.4"},{"introduced":"6.2.0"},{"fixed":"6.2.3"},{"introduced":"6.3.0"},{"fixed":"6.3.2"}]}]
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.7.27"},{"introduced":"4.8.0"},{"fixed":"4.8.23"},{"introduced":"4.9.0"},{"fixed":"4.9.24"},{"introduced":"5.0.0"},{"fixed":"5.0.20"},{"introduced":"5.1.0"},{"fixed":"5.1.17"},{"introduced":"5.2.0"},{"fixed":"5.2.19"},{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"5.4.0"},{"fixed":"5.4.14"},{"introduced":"5.5.0"},{"fixed":"5.5.13"},{"introduced":"5.6.0"},{"fixed":"5.6.12"},{"introduced":"5.7.0"},{"fixed":"5.7.10"},{"introduced":"5.8.0"},{"fixed":"5.8.8"},{"introduced":"5.9.0"},{"fixed":"5.9.8"},{"introduced":"6.0.0"},{"fixed":"6.0.6"},{"introduced":"6.1.0"},{"fixed":"6.1.4"},{"introduced":"6.2.0"},{"fixed":"6.2.3"},{"introduced":"6.3.0"},{"fixed":"6.3.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-5561 wordpress Corrigé dans: 5.7.11+dfsg1-0+deb11u1
Références
- advisory nvd.nist.gov
- advisory github.com
- report wpscan.com
- web lists.debian.org
- web wpscan.com