CVE-2023-39999CWE-200information-disclosure

CVE-2023-39999

Medium · published October 13, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01190 · 67.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-10-13T16:15Z
Affected products (25)
ProductVersionsFixed in
wordpress/wordpress≥ 4.1, ≤ 4.1.38—
wordpress/wordpress≥ 4.2, ≤ 4.2.35—
wordpress/wordpress≥ 4.3, ≤ 4.3.31—
wordpress/wordpress≥ 4.4, ≤ 4.4.30—
wordpress/wordpress≥ 4.5, ≤ 4.5.29—
wordpress/wordpress≥ 4.6, ≤ 4.6.26—
wordpress/wordpress≥ 4.7, ≤ 4.7.26—
wordpress/wordpress≥ 4.8, ≤ 4.8.22—
wordpress/wordpress≥ 4.9, ≤ 4.9.23—
wordpress/wordpress≥ 5.0, ≤ 5.0.19—
wordpress/wordpress≥ 5.1, ≤ 5.1.16—
wordpress/wordpress≥ 5.2, ≤ 5.2.18—
wordpress/wordpress≥ 5.3, ≤ 5.3.15—
wordpress/wordpress≥ 5.4, ≤ 5.4.13—
wordpress/wordpress≥ 5.5, ≤ 5.5.12—
wordpress/wordpress≥ 5.6, ≤ 5.6.11—
wordpress/wordpress≥ 5.7, ≤ 5.7.9—
wordpress/wordpress≥ 5.8, ≤ 5.8.7—
wordpress/wordpress≥ 5.9, ≤ 5.9.7—
wordpress/wordpress≥ 6.0, ≤ 6.0.5—
wordpress/wordpress≥ 6.1, ≤ 6.1.3—
wordpress/wordpress≥ 6.2, ≤ 6.2.2—
wordpress/wordpress≥ 6.3, < 6.3.26.3.2
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (12)
https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/ · [email protected]https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve · [email protected]https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve · [email protected]https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/ · af854a3a-2127-422b-91ae-364da2661108https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve · af854a3a-2127-422b-91ae-364da2661108https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 OCT 11:31Z
    WordPress < 6.3.2 is vulnerable to Broken Access Control
    cvelistv5