CVE-2020-4050
mediumPriorität · verfolgen · 12OT-Risiko · erhöhtEPSS 0.014 · 73. PerzentilEUUSEPSS · bewertet 2026-10-26
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 2.9–6
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (77)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- BIT-wordpress-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPress2024-03-06vendor · osvUS
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- BIT-wordpress-multisite-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPress2024-03-06vendor · osvUS
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202006-987cnnvd
- EUVD-2020-25308enisa_euvd
- BIT-wordpress-2020-4050osv
- BIT-wordpress-multisite-2020-4050osv
- GHSA-4vpv-fgg2-gcqcosv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (28)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/WordPress/wordpress-develop/commit/b8dea76b495f0072523106c6ec46b9ea0d2a0920cnnvd
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4vpv-fgg2-gcqccnnvd
- https://lists.debian.org/debian-lts-announce/2020/07/msg00000.htmlcnnvd
- https://lists.debian.org/debian-lts-announce/2020/09/msg00011.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-4050cnnvd
- https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan