{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39999", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2023-08-08T11:43:05.859Z", "datePublished": "2023-10-13T11:31:16.977Z", "dateUpdated": "2024-08-02T18:18:10.210Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WordPress", "vendor": "WordPress.org", "versions": [{"changes": [{"at": "6.3.2", "status": "unaffected"}], "lessThanOrEqual": "6.3.1", "status": "affected", "version": "6.3", "versionType": "custom"}, {"changes": [{"at": "6.2.3", "status": "unaffected"}], "lessThanOrEqual": "6.2.2", "status": "affected", "version": "6.2", "versionType": "custom"}, {"changes": [{"at": "6.1.4", "status": "unaffected"}], "lessThanOrEqual": "6.13", "status": "affected", "version": "6.1", "versionType": "custom"}, {"changes": [{"at": "6.0.6", "status": "unaffected"}], "lessThanOrEqual": "6.0.5", "status": "affected", "version": "6.0", "versionType": "custom"}, {"changes": [{"at": "5.9.8", "status": "unaffected"}], "lessThanOrEqual": "5.9.7", "status": "affected", "version": "5.9", "versionType": "custom"}, {"changes": [{"at": "5.8.8", "status": "unaffected"}], "lessThanOrEqual": "5.8.7", "status": "affected", "version": "5.8", "versionType": "custom"}, {"changes": [{"at": "5.7.10", "status": "unaffected"}], "lessThanOrEqual": "5.7.9", "status": "affected", "version": "5.7", "versionType": "custom"}, {"changes": [{"at": "5.6.12", "status": "unaffected"}], "lessThanOrEqual": "5.6.11", "status": "affected", "version": "5.6", "versionType": "custom"}, {"changes": [{"at": "5.5.13", "status": "unaffected"}], "lessThanOrEqual": "5.5.12", "status": "affected", "version": "5.5", "versionType": "custom"}, {"changes": [{"at": "5.4.14", "status": "unaffected"}], "lessThanOrEqual": "5.4.13", "status": "affected", "version": "5.4", "versionType": "custom"}, {"changes": [{"at": "5.3.16", "status": "unaffected"}], "lessThanOrEqual": "5.3.15", "status": "affected", "version": "5.3", "versionType": "custom"}, {"changes": [{"at": "5.2.19", "status": "unaffected"}], "lessThanOrEqual": "5.2.18", "status": "affected", "version": "5.2", "versionType": "custom"}, {"changes": [{"at": "5.1.17", "status": "unaffected"}], "lessThanOrEqual": "5.1.16", "status": "affected", "version": "5.1", "versionType": "custom"}, {"changes": [{"at": "5.0.20", "status": "unaffected"}], "lessThanOrEqual": "5.0.19", "status": "affected", "version": "5.0", "versionType": "custom"}, {"changes": [{"at": "4.9.24", "status": "unaffected"}], "lessThanOrEqual": "4.9.23", "status": "affected", "version": "4.9", "versionType": "custom"}, {"changes": [{"at": "4.8.23", "status": "unaffected"}], "lessThanOrEqual": "4.8.22", "status": "affected", "version": "4.8", "versionType": "custom"}, {"changes": [{"at": "4.7.27", "status": "unaffected"}], "lessThanOrEqual": "4.7.26", "status": "affected", "version": "4.7", "versionType": "custom"}, {"changes": [{"at": "4.6.27", "status": "unaffected"}], "lessThanOrEqual": "4.6.26", "status": "affected", "version": "4.6", "versionType": "custom"}, {"changes": [{"at": "4.5.30", "status": "unaffected"}], "lessThanOrEqual": "4.5.29", "status": "affected", "version": "4.5", "versionType": "custom"}, {"changes": [{"at": "4.4.31", "status": "unaffected"}], "lessThanOrEqual": "4.4.30", "status": "affected", "version": "4.4", "versionType": "custom"}, {"changes": [{"at": "4.3.32", "status": "unaffected"}], "lessThanOrEqual": "4.3.31", "status": "affected", "version": "4.3", "versionType": "custom"}, {"changes": [{"at": "4.2.36", "status": "unaffected"}], "lessThanOrEqual": "4.2.35", "status": "affected", "version": "4.2", "versionType": "custom"}, {"changes": [{"at": "4.1.39", "status": "unaffected"}], "lessThanOrEqual": "4.1.38", "status": "affected", "version": "4.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Rafie Muhammad (Patchstack)"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jb Audras (WordPress Security Team)"}], "datePublic": "2023-10-13T05:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Exposure of Sensitive Information to an Unauthorized Actor in WordPress<span style=\"background-color: var(--wht);\">&nbsp;from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.</span>"}], "value": "Exposure of Sensitive Information to an Unauthorized Actor in WordPress\u00a0from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2023-10-13T11:31:16.977Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve"}, {"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to suitable (6.3.2,&nbsp;6.2.3, 6.1.4, 6.0.6, 5.9.8, 5.8.8, 5.7.10, 5.6.12, 5.5.13, 5.4.14, 5.3.16, 5.2.19, 5.1.17, 5.0.20, 4.9.24, 4.8.23, 4.7.27, 4.6.27, 4.5.30, 4.4.31, 4.3.32, 4.2.36, 4.1.39) or a higher version."}], "value": "Update to suitable (6.3.2,\u00a06.2.3, 6.1.4, 6.0.6, 5.9.8, 5.8.8, 5.7.10, 5.6.12, 5.5.13, 5.4.14, 5.3.16, 5.2.19, 5.1.17, 5.0.20, 4.9.24, 4.8.23, 4.7.27, 4.6.27, 4.5.30, 4.4.31, 4.3.32, 4.2.36, 4.1.39) or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress < 6.3.2 is vulnerable to Broken Access Control", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.210Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve"}, {"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABB9B812-77A2-48A2-B20C-F93F1927074D", "versionEndIncluding": "4.1.38", "versionStartIncluding": "4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E1AF690-CF5B-43EC-BFC3-0D3BFBD68026", "versionEndIncluding": "4.2.35", "versionStartIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "C16E8601-4A33-46DD-8ED7-4D0366D627C6", "versionEndIncluding": "4.3.31", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "5045F892-3036-4887-9044-9560EC8E4CC4", "versionEndIncluding": "4.4.30", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "847B4EEB-CE33-4FE7-BE01-7F26FA214CA7", "versionEndIncluding": "4.5.29", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "F10FE77A-E6E4-4F22-ACD9-B5302D330AEC", "versionEndIncluding": "4.6.26", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "26FF60CD-3303-4B7E-A341-1336A1B59B02", "versionEndIncluding": "4.7.26", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DB9AC76-3041-4B4C-8015-3FB4F997F3D0", "versionEndIncluding": "4.8.22", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "C37B8606-CDC9-41AE-A215-8C4CAA181FE2", "versionEndIncluding": "4.9.23", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F999E7C-2623-456C-BB90-0477F797FEEF", "versionEndIncluding": "5.0.19", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D3ED9AF-2678-45E9-9D05-87DDB335B3A8", "versionEndIncluding": "5.1.16", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AC73861-C8F7-4CF3-BD3E-E192B21C6E9A", "versionEndIncluding": "5.2.18", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2C8561A-B374-43F1-A075-B3C0CAA34790", "versionEndIncluding": "5.3.15", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "D20123C6-5E39-41D4-8231-8E02B78997BC", "versionEndIncluding": "5.4.13", "versionStartIncluding": "5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "C69CC301-A008-4BAF-A207-0892673CAEFF", "versionEndIncluding": "5.5.12", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A83D406-52C7-4655-9048-9393A3D23DA4", "versionEndIncluding": "5.6.11", "versionStartIncluding": "5.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "6797639F-F04C-4BFA-B37B-98E9D23D8E33", "versionEndIncluding": "5.7.9", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CD23244-9849-453C-A206-4563997EF5EE", "versionEndIncluding": "5.8.7", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "51D5D6E9-387D-4A4B-A613-0E0B9D74B8F1", "versionEndIncluding": "5.9.7", "versionStartIncluding": "5.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D0A0B36-9A2F-415A-A404-EE0FF6BC63A3", "versionEndIncluding": "6.0.5", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "A85EAB94-7EE7-4B4D-82E6-132FCF8662C4", "versionEndIncluding": "6.1.3", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "B55FDB69-E699-43A1-8575-52E0B33F8863", "versionEndIncluding": "6.2.2", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "4ED48F8A-D2AC-45FE-9B5F-231A0666A897", "versionEndExcluding": "6.3.2", "versionStartIncluding": "6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor in WordPress\u00a0from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38."}, {"lang": "es", "value": "Exposici\u00f3n de Informaci\u00f3n Confidencial a un Actor No Autorizado en WordPress desde 6.3 hasta 6.3.1, desde 6.2 hasta 6.2.2, desde 6.1 hasta 6.13, desde 6.0 hasta 6.0.5, desde 5.9 hasta 5.9.7, desde 5.8 hasta 5.8.7, del 5.7 al 5.7.9, del 5.6 al 5.6.11, del 5.5 al 5.5.12, del 5.4 al 5.4.13, del 5.3 al 5.3.15, del 5.2 al 5.2.18, del 5.1 al 5.1.16, del 5.0 al 5.0.19, del 4.9 al 4.9.23, del 4.8 al 4.8.22, del 4.7 al 4.7.26, del 4.6 al 4.6.26, del 4.5 al 4.5.29, del 4.4 al 4.4.30, del 4.3 al 4.3.31, del 4.2 al 4.2.35, del 4.1 al 4.1.38."}], "id": "CVE-2023-39999", "lastModified": "2024-02-16T17:16:07.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2023-10-13T12:15:09.970", "references": [{"source": "audit@patchstack.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"}, {"source": "audit@patchstack.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/"}, {"source": "audit@patchstack.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/"}, {"source": "audit@patchstack.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/"}, {"source": "audit@patchstack.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve"}, {"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "audit@patchstack.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}