CVE-2021-39200

Katalog CVE

CVSS 5.3 · Medium EPSS 2,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada wordpress, debian linux. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Rincian

Terbit di NVD

9 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m9hc-7v5q-x8q5 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4985 advisory pihak ketiga
• https://hackerone.com/reports/1142140 permissions required