Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-39200
HistorySep 09, 2021 - 12:00 a.m.

CVE-2021-39200

2021-09-0900:00:00
ubuntu.com
ubuntu.com
26
wordpress
security patch
wp_die()

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

39.9%

WordPress is a free and open-source content management system written in
PHP and paired with a MySQL or MariaDB database. In affected versions
output data of the function wp_die() can be leaked under certain
conditions, which can include data like nonces. It can then be used to
perform actions on your behalf. This has been patched in WordPress 5.8.1,
along with any older affected versions via minor releases. It’s strongly
recommended that you keep auto-updates enabled to receive the fix.

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

39.9%