CVE-2018-20149

原文の説明

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

影響を受けるソフトウェア

• WordPress * リポジトリ・パッケージ一致

詳細

公開日

2018-12-15

最終更新

2024-08-05

参考資料

• cve.org/CVE-2018-20149
• nvd.nist.gov/vuln/detail/CVE-2018-20149
• www.securityfocus.com/bid/106220
• wordpress.org/support/wordpress-version/version-5-0-1/
• codex.wordpress.org/Version_4.9.9
• wpvulndb.com/vulnerabilities/9175
• github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a
• www.debian.org/security/2019/dsa-4401
• wordpress.org/news/2018/12/wordpress-5-0-1-security-release/
• lists.debian.org/debian-lts-announce/2019/02/msg00019.html
• www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords/