Vulnerabilities > CVE-2020-11027 - Operation on a Resource after Expiration or Release vulnerability in multiple products

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
debian
wordpress
CWE-672
nessus

Summary

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Vulnerable Configurations

Part Description Count
OS
Debian
3
Application
Wordpress
487

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4677.NASL
    descriptionSeveral vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.
    last seen2020-05-12
    modified2020-05-07
    plugin id136373
    published2020-05-07
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136373
    titleDebian DSA-4677-1 : wordpress - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4677. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(136373);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/19");
    
      script_cve_id("CVE-2019-16217", "CVE-2019-16218", "CVE-2019-16219", "CVE-2019-16220", "CVE-2019-16221", "CVE-2019-16222", "CVE-2019-16223", "CVE-2019-16780", "CVE-2019-16781", "CVE-2019-17669", "CVE-2019-17671", "CVE-2019-17672", "CVE-2019-17673", "CVE-2019-17674", "CVE-2019-17675", "CVE-2019-20041", "CVE-2019-20042", "CVE-2019-20043", "CVE-2019-9787", "CVE-2020-11025", "CVE-2020-11026", "CVE-2020-11027", "CVE-2020-11028", "CVE-2020-11029", "CVE-2020-11030");
      script_xref(name:"DSA", value:"4677");
      script_xref(name:"IAVA", value:"2020-A-0191-S");
    
      script_name(english:"Debian DSA-4677-1 : wordpress - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities were discovered in Wordpress, a web blogging
    tool. They allowed remote attackers to perform various Cross-Side
    Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create
    files on the server, disclose private information, create open
    redirects, poison cache, and bypass authorization access and input
    sanitation."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924546"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=939543"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942459"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946905"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959391"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/wordpress"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/wordpress"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/buster/wordpress"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2020/dsa-4677"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the wordpress packages.
    
    For the oldstable distribution (stretch), these problems have been
    fixed in version 4.7.5+dfsg-2+deb9u6.
    
    For the stable distribution (buster), these problems have been fixed
    in version 5.0.4+dfsg1-1+deb10u2."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/07");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"10.0", prefix:"wordpress", reference:"5.0.4+dfsg1-1+deb10u2")) flag++;
    if (deb_check(release:"10.0", prefix:"wordpress-l10n", reference:"5.0.4+dfsg1-1+deb10u2")) flag++;
    if (deb_check(release:"10.0", prefix:"wordpress-theme-twentynineteen", reference:"5.0.4+dfsg1-1+deb10u2")) flag++;
    if (deb_check(release:"10.0", prefix:"wordpress-theme-twentyseventeen", reference:"5.0.4+dfsg1-1+deb10u2")) flag++;
    if (deb_check(release:"10.0", prefix:"wordpress-theme-twentysixteen", reference:"5.0.4+dfsg1-1+deb10u2")) flag++;
    if (deb_check(release:"9.0", prefix:"wordpress", reference:"4.7.5+dfsg-2+deb9u6")) flag++;
    if (deb_check(release:"9.0", prefix:"wordpress-l10n", reference:"4.7.5+dfsg-2+deb9u6")) flag++;
    if (deb_check(release:"9.0", prefix:"wordpress-theme-twentyfifteen", reference:"4.7.5+dfsg-2+deb9u6")) flag++;
    if (deb_check(release:"9.0", prefix:"wordpress-theme-twentyseventeen", reference:"4.7.5+dfsg-2+deb9u6")) flag++;
    if (deb_check(release:"9.0", prefix:"wordpress-theme-twentysixteen", reference:"4.7.5+dfsg-2+deb9u6")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-2208.NASL
    descriptionMultiple CVE(s) were discovered in the src:wordpress package. CVE-2020-11026 Files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. CVE-2020-11027 A password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. CVE-2020-11028 Some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. CVE-2020-11029 A vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. For Debian 8
    last seen2020-05-15
    modified2020-05-12
    plugin id136484
    published2020-05-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136484
    titleDebian DLA-2208-1 : wordpress security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-2208-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(136484);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/19");
    
      script_cve_id("CVE-2020-11026", "CVE-2020-11027", "CVE-2020-11028", "CVE-2020-11029");
      script_xref(name:"IAVA", value:"2020-A-0191-S");
    
      script_name(english:"Debian DLA-2208-1 : wordpress security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple CVE(s) were discovered in the src:wordpress package.
    
    CVE-2020-11026
    
    Files with a specially crafted name when uploaded to the Media section
    can lead to script execution upon accessing the file. This requires an
    authenticated user with privileges to upload files.
    
    CVE-2020-11027
    
    A password reset link emailed to a user does not expire upon changing
    the user password. Access would be needed to the email account of the
    user by a malicious party for successful execution.
    
    CVE-2020-11028
    
    Some private posts, which were previously public, can result in
    unauthenticated disclosure under a specific set of conditions.
    
    CVE-2020-11029
    
    A vulnerability in the stats() method of class-wp-object-cache.php can
    be exploited to execute cross-site scripting (XSS) attacks.
    
    For Debian 8 'Jessie', these problems have been fixed in version
    4.1.30+dfsg-0+deb8u1.
    
    We recommend that you upgrade your wordpress packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2020/05/msg00011.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/wordpress"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress-l10n");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress-theme-twentyfifteen");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress-theme-twentyfourteen");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordpress-theme-twentythirteen");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/30");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/12");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"wordpress", reference:"4.1.30+dfsg-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"wordpress-l10n", reference:"4.1.30+dfsg-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"wordpress-theme-twentyfifteen", reference:"4.1.30+dfsg-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"wordpress-theme-twentyfourteen", reference:"4.1.30+dfsg-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"wordpress-theme-twentythirteen", reference:"4.1.30+dfsg-0+deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");