November 20, 2023
Severity Medium Analysis Summary Agent Tesla is a very popular spyware Trojan built for the.NET framework. Since its initial appearance in 2014, this has been deployed […]
Rewterz Threat Advisory – CVE-2019-8071 – Adobe Download Manager Privilege Escalation Vulnerability
October 16, 2019Rewterz Threat Alert – Diving Into Sodinokibi Ransomware
October 16, 2019Rewterz Threat Advisory – CVE-2019-8071 – Adobe Download Manager Privilege Escalation Vulnerability
October 16, 2019Rewterz Threat Alert – Diving Into Sodinokibi Ransomware
October 16, 2019
Severity
Medium
Analysis Summary
WordPress 5.2.3 and prior versions are affected by multiple vulnerabilities. An attacker could exploit some of these vulnerabilities to take control of an affected website. Updated versions of WordPress 5.1 and earlier are also available for any users who have not yet updated to 5.2. Following are the issues found in 5.2.3. that are now fixed in version 5.2.4.
- An issue where stored XSS (cross-site scripting) could be added via the Customizer.
- A method of viewing unauthenticated posts.
- A way to create a stored XSS to inject Javascript into style tags.
- A method to poison the cache of JSON GET requests via the Vary: Origin header.
- A server-side request forgery in the way that URLs are validated.
- Issues related to referrer validation in the admin.
WordPress 5.2.4 is a short-cycle security release. The next major release will be version 5.3.
Impact
Website Takeover
Affected Vendors
WordPress
Affected Products
WordPress 5.2.3
Remediation
Upgrade to WordPress 5.2.4.