CVE-2023-5561

2023-10-1620:15:18

Debian Security Bug Tracker

security-tracker.debian.org

wordpress

rest api

user field restriction

oracle attack

email addresses

cve-2023-5561

unix

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.7%

JSON

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

OSVersionArchitecturePackageVersionFilename
Debian12allwordpress< 6.1.6+dfsg1-0+deb12u1wordpress_6.1.6+dfsg1-0+deb12u1_all.deb
Debian11allwordpress< 5.7.11+dfsg1-0+deb11u1wordpress_5.7.11+dfsg1-0+deb11u1_all.deb
Debian999allwordpress< 6.3.2+dfsg1-1wordpress_6.3.2+dfsg1-1_all.deb
Debian13allwordpress< 6.3.2+dfsg1-1wordpress_6.3.2+dfsg1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	wordpress	< 6.1.6+dfsg1-0+deb12u1	wordpress_6.1.6+dfsg1-0+deb12u1_all.deb
Debian	11	all	wordpress	< 5.7.11+dfsg1-0+deb11u1	wordpress_5.7.11+dfsg1-0+deb11u1_all.deb
Debian	999	all	wordpress	< 6.3.2+dfsg1-1	wordpress_6.3.2+dfsg1-1_all.deb
Debian	13	all	wordpress	< 6.3.2+dfsg1-1	wordpress_6.3.2+dfsg1-1_all.deb