SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-20149

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

MEDIUM 5.4EPSS 2.89%

Does this matter?

Lower severity and a low EPSS score (2.89%). Track it; it rarely justifies an emergency change on its own.

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

CVSS 3.0
5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
2.89% probability · 86th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
wordpress/wordpress · debian/debian linux
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.