CVE-2024-31211
Remote Code Execution in `WP_HTML_Token`
Résumé
Remote Code Execution in WP_HTML_Token
Description d'origine
La description telle que publiée par la source (souvent en anglais).
WordPress is an open publishing platform for the Web. Unserialization of instances of the WP_HTML_Token class allows for code execution via its __destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}]
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-31211 wordpress Corrigé dans: 6.4.2+dfsg1-1
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com