Vulnerability-Lookup

GHSA-PPXH-5QQ2-77G8

Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2023-01-20 18:30

Details

WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.

Severity ?

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-20043"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-27T08:15:00Z",
    "severity": "MODERATE"
  },
  "details": "WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.",
  "id": "GHSA-ppxh-5qq2-77g8",
  "modified": "2023-01-20T18:30:23Z",
  "published": "2022-05-24T17:05:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20043"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9"
    },
    {
      "type": "WEB",
      "url": "https://core.trac.wordpress.org/changeset/46893/trunk"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2020/Jan/8"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release"
    },
    {
      "type": "WEB",
      "url": "https://wpvulndb.com/vulnerabilities/9973"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4599"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4677"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2019-20043 (GCVE-0-2019-20043)

Vulnerability from cvelistv5 – Published: 2019-12-27 07:14 – Updated: 2024-08-05 02:32

Summary

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://wpvulndb.com/vulnerabilities/9973	x_refsource_MISC
	https://wordpress.org/news/2019/12/wordpress-5-3-…	x_refsource_MISC
	https://core.trac.wordpress.org/changeset/46893/trunk	x_refsource_MISC
	https://github.com/WordPress/wordpress-develop/co…	x_refsource_MISC
	https://seclists.org/bugtraq/2020/Jan/8	mailing-listx_refsource_BUGTRAQ
	https://www.debian.org/security/2020/dsa-4599	vendor-advisoryx_refsource_DEBIAN
	https://github.com/WordPress/wordpress-develop/se…	x_refsource_CONFIRM
	https://www.debian.org/security/2020/dsa-4677	vendor-advisoryx_refsource_DEBIAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:32:10.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/9973"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://core.trac.wordpress.org/changeset/46893/trunk"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9"
          },
          {
            "name": "20200108 [SECURITY] [DSA 4599-1] wordpress security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/8"
          },
          {
            "name": "DSA-4599",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4599"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw"
          },
          {
            "name": "DSA-4677",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4677"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-06T12:06:07.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/9973"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://core.trac.wordpress.org/changeset/46893/trunk"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9"
        },
        {
          "name": "20200108 [SECURITY] [DSA 4599-1] wordpress security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/8"
        },
        {
          "name": "DSA-4599",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4599"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw"
        },
        {
          "name": "DSA-4677",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4677"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-20043",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpvulndb.com/vulnerabilities/9973",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/9973"
            },
            {
              "name": "https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/",
              "refsource": "MISC",
              "url": "https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/"
            },
            {
              "name": "https://core.trac.wordpress.org/changeset/46893/trunk",
              "refsource": "MISC",
              "url": "https://core.trac.wordpress.org/changeset/46893/trunk"
            },
            {
              "name": "https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9",
              "refsource": "MISC",
              "url": "https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9"
            },
            {
              "name": "20200108 [SECURITY] [DSA 4599-1] wordpress security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/8"
            },
            {
              "name": "DSA-4599",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4599"
            },
            {
              "name": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw",
              "refsource": "CONFIRM",
              "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw"
            },
            {
              "name": "DSA-4677",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4677"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-20043",
    "datePublished": "2019-12-27T07:14:16.000Z",
    "dateReserved": "2019-12-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T02:32:10.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-PPXH-5QQ2-77G8

CVE-2019-20043 (GCVE-0-2019-20043)

Tags

Sightings

Nomenclature