high8.8
CVE-2019-17675
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Impact
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | before 5.2.4 |
| Debian | Debian Linux | Versions 8.0, 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
- https://core.trac.wordpress.org/changeset/46477
- https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
- https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
- https://wpvulndb.com/vulnerabilities/9913
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677
- https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
- https://core.trac.wordpress.org/changeset/46477
- https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
- https://lists.debian.org/debian-lts-announce/2019/11/msg00000.html
- https://seclists.org/bugtraq/2020/Jan/8
- https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
- https://wpvulndb.com/vulnerabilities/9913
- https://www.debian.org/security/2020/dsa-4599
- https://www.debian.org/security/2020/dsa-4677