CVE-2018-20149 — Cross-site Scripting in Wordpress

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
4.4%
top 10.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WordpressDebian WordpressDebian Linux
Timeline
PublishedDec 14
Latest updateSep 16

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 5.0.1+dfsg1-1 (bookworm)
▶NVDwordpress/wordpress5.0 — 5.0.1+1
▶Debianwordpress/wordpress< 5.0.1+dfsg1-1+3

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-33wf-jvrq-cxjv: In WordPress before 4↗2022-05-14
▶
OSV
CVE-2018-20149: In WordPress before 4↗2018-12-14
▶

📋Vendor Advisories

1
Debian
CVE-2018-20149: wordpress - In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is u...↗2018
▶

📄Research Papers

1
arXiv
Web Application Weakness Ontology Based on Vulnerability Data↗2022-09-16
▶
CVE-2018-20149 — Cross-site Scripting in Wordpress | cvebase