CVE-2020-35934

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API…

Medium · published January 1, 2021

CVSS v3.1
4.3
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01072 · 64.6th percentile
Published
2021-01-01T01:25Z
EPSS history
Timeline
  • 01 JAN 01:25Z
    The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API…
    cvelistv5