8.1

CVE-2020-11027: debian debian_linux

CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-11027DEBIAN-CVE-2020-11027
Published 30-04-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-11027 is a high (CVSS 8.1) vulnerability in debian debian_linux. EPSS estimates a 13.63% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
13.63%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 2
DLA-2208-1DSA-4677-1

Timeline

  1. 30-04-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

13.63%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.63% on 20-09-2026

20-09-202620-10-2026
EPSS score
13.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databasephpUnverified

    WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Debian2 products
Wordpress2 products
  • wordpress< 3.7 (fixed in 3.7.33) | ≥ 3.7, ≤ 3.7.32 (fixed in 3.7.33) | ≥ 3.8, ≤ 3.8.32 (fixed in 3.7.33) | ≥ 3.9, ≤ 3.9.30 (fixed in 3.7.33) | ≥ 4.0, ≤ 4.0.29 (fixed in 3.7.33) | ≥ 4.1, ≤ 4.1.29 (fixed in 3.7.33) | ≥ 4.2, ≤ 4.2.26 (fixed in 3.7.33) | ≥ 4.3, ≤ 4.3.22 (fixed in 3.7.33) | ≥ 4.4, ≤ 4.4.21 (fixed in 3.7.33) | ≥ 4.5, ≤ 4.5.20 (fixed in 3.7.33) | ≥ 4.6, ≤ 4.6.17 (fixed in 3.7.33) | ≥ 4.7, ≤ 4.7.16 (fixed in 3.7.33) | ≥ 4.8, ≤ 4.8.12 (fixed in 3.7.33) | ≥ 4.9, ≤ 4.9.13 (fixed in 3.7.33) | ≥ 5.0, ≤ 5.0.8 (fixed in 3.7.33) | ≥ 5.1, ≤ 5.1.4 (fixed in 3.7.33) | ≥ 5.2, ≤ 5.2.5 (fixed in 3.7.33) | ≥ 5.3, ≤ 5.3.2 (fixed in 3.7.33) | 5.4 (fixed in 3.7.33)
  • wordpress≥ 5.4.0, < 5.4.1 | ≥ 5.3.0, < 5.3.3 | ≥ 5.2.0, < 5.2.6 | ≥ 5.1.0, < 5.1.5 | ≥ 5.0.0, < 5.0.9 | ≥ 4.9.0, < 4.9.14 | ≥ 4.8.0, < 4.8.13 | ≥ 4.7.0, < 4.7.17 | ≥ 4.6.0, < 4.6.18 | ≥ 4.5.0, < 4.5.21 | ≥ 4.4.0, < 4.4.22 | ≥ 4.3.0, < 4.3.23 | ≥ 4.2.0, < 4.2.27 | ≥ 4.1.0, < 4.1.30 | ≥ 4.0.0, < 4.0.30 | ≥ 3.9.0, < 3.9.31 | ≥ 3.8.0, < 3.8.33 | ≥ 3.7.0, < 3.7.33 | ≥ 3.7, < 3.7.33 | ≥ 3.8, < 3.8.33 | ≥ 3.9, < 3.9.31 | ≥ 4.0, < 4.0.30 | ≥ 4.1, < 4.1.30 | ≥ 4.2, < 4.2.27 | ≥ 4.3, < 4.3.23 | ≥ 4.4, < 4.4.22 | ≥ 4.5, < 4.5.21 | ≥ 4.6, < 4.6.18 | ≥ 4.7, < 4.7.17 | ≥ 4.8, < 4.8.13 | ≥ 4.9, < 4.9.14 | ≥ 5.0, < 5.0.9 | ≥ 5.1, < 5.1.5 | ≥ 5.2, < 5.2.6 | ≥ 5.3, < 5.3.3 | 5.4
Ubuntu1 product
  • wordpressAll versions (No fix recorded)

3 vendors · 5 products

References

9 links