CVE-2018-20149 WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads
MediumCVSS 5.4
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| debian/wordpress(Debian:13) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| debian/wordpress(Debian:14) | < 5.0.1+dfsg1-1 | 5.0.1+dfsg1-1 |
| WordPress | < 4.9.9 | 4.9.9 |
| WordPress | >= 5.0, < 5.0.1 | 5.0.1 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| WordPress(WordPress) | < 3.7 | 3.7 |
| WordPress(WordPress) | >= 3.7, < 3.7.28 | 3.7.28 |
| WordPress(WordPress) | >= 3.8, < 3.8.28 | 3.8.28 |
| WordPress(WordPress) | >= 3.9, < 3.9.26 | 3.9.26 |
| WordPress(WordPress) | >= 4.0, < 4.0.25 | 4.0.25 |
| WordPress(WordPress) | >= 4.1, < 4.1.25 | 4.1.25 |
| WordPress(WordPress) | >= 4.2, < 4.2.22 | 4.2.22 |
| WordPress(WordPress) | >= 4.3, < 4.3.18 | 4.3.18 |
| WordPress(WordPress) | >= 4.4, < 4.4.17 | 4.4.17 |
| WordPress(WordPress) | >= 4.5, < 4.5.16 | 4.5.16 |
| WordPress(WordPress) | >= 4.6, < 4.6.13 | 4.6.13 |
| WordPress(WordPress) | >= 4.7, < 4.7.12 | 4.7.12 |
| WordPress(WordPress) | >= 4.8, < 4.8.8 | 4.8.8 |
| WordPress(WordPress) | >= 4.9, < 4.9.9 | 4.9.9 |
| WordPress(WordPress) | = 5.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-20149 vendor-advisory
- 106220 third-party-advisory vdb-entry
- codex.wordpress.org product vendor-advisory
- github.com patch third-party-advisory
- [debian-lts-announce] 20190211 [SECURITY] [DLA 1673-1] wordpress security update mailing-list third-party-advisory
- wordpress.org release-notes vendor-advisory
- wordpress.org release-notes vendor-advisory
- wpvulndb.com vendor-advisory
- DSA-4401 third-party-advisory vendor-advisory
- www.zdnet.com press-media-coverage third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking