BIT-wordpress-2023-5561

vendorUSosv

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

Advisory ansehen veröffentlicht 2024-03-06Lizenz: per source

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-5561US	medium5.3	4.33% (91st)	Exploit	2023-10-16
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have publishe…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://lists.debian.org/debian-lts-announce/2023/11/msg00014.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-5561WEB
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/ADVISORY
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan