CVE-2020-4048 Information

Description

In affected versions of WordPress due to an issue in wp_validate_redirect() and URL sanitization an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2 along with all the previously affected versions via a minor release (5.3.4 5.2.7 5.1.6 5.0.10 4.9.15 4.8.14 4.7.18 4.6.19 4.5.22 4.4.23 4.3.24 4.2.28 4.1.31 4.0.31 3.9.32 3.8.34 3.7.34).

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Reference

https://github.com/WordPress/wordpress-develop/commit/6ef777e9a022bee2a80fa671118e7e2657e52693 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-q6pw-gvf4-5fj5 https://lists.debian.org/debian-lts-announce/2020/07/msg00000.html https://lists.debian.org/debian-lts-announce/2020/09/msg00011.html https://lists.fedoraproject.org/archives/list/[email protected]/message/773N2ZV7QEMBGKH6FBKI6Q5S3YJMW357/ https://lists.fedoraproject.org/archives/list/[email protected]/message/ODNHXVJS25YVWYQHOCICXTLIN5UYJFDN/ https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/ https://www.debian.org/security/2020/dsa-4709

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

5.7