CVE-2020-4049: debian debian_linux
CVSS: 3.5v2.0LowModified
AliasesUBUNTU-CVE-2020-4049DEBIAN-CVE-2020-4049
Published 12-06-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-4049 is a low (CVSS 3.5) vulnerability in debian debian_linux. EPSS estimates a 2.53% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities.
CVSS score
3.5/10
010
Low · v2.0 (NVD)EPSS score
2.53%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 12-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
CVSS metrics
6 scores · 5 sources · 2 versionsLow 2.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated2.4LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated2.4LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
- NVDNIST2.4LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
- wordfenceSource2.4LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.53%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.53% on 19-09-2026
19-09-202619-10-2026
EPSS score2.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Wordpress3 products
- wordpress< 3.7 (fixed in 3.7.34) | ≥ 3.7, ≤ 3.7.33 (fixed in 3.7.34) | ≥ 3.8, ≤ 3.8.33 (fixed in 3.7.34) | ≥ 3.9, ≤ 3.9.31 (fixed in 3.7.34) | ≥ 4.0, ≤ 4.0.30 (fixed in 3.7.34) | ≥ 4.1, ≤ 4.1.30 (fixed in 3.7.34) | ≥ 4.2, ≤ 4.2.27 (fixed in 3.7.34) | ≥ 4.3, ≤ 4.3.23 (fixed in 3.7.34) | ≥ 4.4, ≤ 4.4.22 (fixed in 3.7.34) | ≥ 4.5, ≤ 4.5.21 (fixed in 3.7.34) | ≥ 4.6, ≤ 4.6.18 (fixed in 3.7.34) | ≥ 4.7, ≤ 4.7.17 (fixed in 3.7.34) | ≥ 4.8, ≤ 4.8.13 (fixed in 3.7.34) | ≥ 4.9, ≤ 4.9.14 (fixed in 3.7.34) | ≥ 5.0, ≤ 5.0.9 (fixed in 3.7.34) | ≥ 5.1, ≤ 5.1.5 (fixed in 3.7.34) | ≥ 5.2, ≤ 5.2.6 (fixed in 3.7.34) | ≥ 5.3, ≤ 5.3.3 (fixed in 3.7.34)
- wordpress≥ 3.7, < 3.7.34 | ≥ 3.8, < 3.8.34 | ≥ 3.9, < 3.9.32 | ≥ 4.0, < 4.0.31 | ≥ 4.1, < 4.1.31 | ≥ 4.2, < 4.2.28 | ≥ 4.3, < 4.3.24 | ≥ 4.4, < 4.4.23 | ≥ 4.5, < 4.5.22 | ≥ 4.6, < 4.6.19 | ≥ 4.7, < 4.7.18 | ≥ 4.8, < 4.8.14 | ≥ 4.9, < 4.9.15 | ≥ 5.0, < 5.0.10 | ≥ 5.1, < 5.1.6 | ≥ 5.2, < 5.2.7 | ≥ 5.3.0, < 5.3.4 | ≥ 5.4, < 5.4.2
- wordpress-develop≥ 5.4.0, < 5.4.2 | ≥ 5.3.0, < 5.3.4 | ≥ 5.2.0, < 5.2.7 | ≥ 5.1.0, < 5.1.6 | ≥ 5.0.0, < 5.0.10 | ≥ 4.9.0, < 4.9.15 | ≥ 4.8.0, < 4.8.14 | ≥ 4.7.0, < 4.7.18 | ≥ 4.6.0, < 4.6.19 | ≥ 4.5.0, < 4.5.22 | ≥ 4.4.0, < 4.4.23 | ≥ 4.3.0, < 4.3.24 | ≥ 4.2.0, < 4.2.28 | ≥ 4.1.0, < 4.1.31 | ≥ 4.0.0, < 4.0.31 | ≥ 3.9.0, < 3.9.32 | ≥ 3.8.0, < 3.8.34 | ≥ 3.7.0, < 3.7.34
Debian2 products
- wordpress< 5.4.2+dfsg1-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Fedoraproject1 product
- fedoraEOL31 | 32
Ubuntu1 product
- wordpressAll versions (No fix recorded)
4 vendors · 7 products
References
13 links- wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/X Refsource MISCREPORTVendor Advisory
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-87h4-phjv-rm6pX Refsource CONFIRMREPORTThird Party Advisory
- github.com/WordPress/wordpress-develop/commit/404f397b4012fd9d382e55bf7d206c1317f01148X Refsource MISCREPORTPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/07/msg00000.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory