CVE-2024-4439
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insuffic...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
影響パッケージ
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.8"},{"introduced":"6.1.0"},{"fixed":"6.1.6"},{"introduced":"6.2.0"},{"fixed":"6.2.5"},{"introduced":"6.3.0"},{"fixed":"6.3.4"},{"introduced":"6.4.0"},{"fixed":"6.4.4"},{"introduced":"6.5.0"},{"fixed":"6.5.2"}]}]
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.8"},{"introduced":"6.1.0"},{"fixed":"6.1.6"},{"introduced":"6.2.0"},{"fixed":"6.2.5"},{"introduced":"6.3.0"},{"fixed":"6.3.4"},{"introduced":"6.4.0"},{"fixed":"6.4.4"},{"introduced":"6.5.0"},{"fixed":"6.5.2"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-4439 wordpress 修正版: 6.1.9+dfsg1-0+deb12u1
参照URL
- advisory wordpress.org
- advisory wordfence.com
- advisory wordfence.com
- patch core.trac.wordpress.org
- patch core.trac.wordpress.org
- web nvd.nist.gov