CVE-2020-4047

In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

References

Affected packages

Git / github.com/wordpress/wordpress

Affected ranges

Type

GIT

Repo

https://github.com/wordpress/wordpress

Events

Introduced

3921fd373acaeeeee2029f762b676075cf375b33

Fixed

6a7a8a0d2daab6a40cc84e431a726d730d2bde39

Introduced

36470a480cac07d34a355e9f8a9409c1349b6e07

Fixed

b29e8559570e2ee5901242ea6ee5270cfc12eaf9

Introduced

54a3b49fa91b7beeb3da2f448154f9e75f005a9a

Fixed

39aaf4a53b2c58e0c15133c07eed926011bb8830

Introduced

842221094a5011886291b21fd7c705835d69e0bc

Fixed

737cceb8d2ce546c2470be162c7f09a559a5aa69

Introduced

e5e791f331d371ad6262c1893d84f5f2b6c26464

Fixed

ff8c9a02f58af3ef7b599d22a769ed50af9975f5

Introduced

87bf150016e042bc3e21f2f1cb9de44042b8cdb1

Fixed

909db56833d2cdaa84008c08c70ccbf8d443f15e

Introduced

b57f3aa5f00a127f209eff74b78787dd3fd5ed4d

Fixed

1681d8156e716aad9811d4a6a7b1a371913575c4

Introduced

f6a29831c76d2dbe82e9ae673539f910654c58a4

Fixed

049c6e0636b6712d1bfe6fb736956897e0518420

Introduced

e3aafee3f2bc07e09bf79389f20ea3db731466c3

Fixed

2aec937d151925d6b6f8930557025ea70dd585c2

Introduced

fe47e6139dbfc0f0c9ce0d79da77926b5fceaa77

Fixed

7a8356c9b0707fbcbcacb09727dbd608557599dd

Introduced

14247ee4302378d292863865c643abe99bbfe3c7

Fixed

a2209a9fc18f6e1da8a2cd74257f9af75357783d

Introduced

06fa4161aa74619239cf27017d124081c825684a

Fixed

10cc339ba838338b763afd4076397088a51d0249

Introduced

29ffbff370968ae48a1b7a34e35c8b8e75cf0f91

Fixed

4e31f50cf81a8660bb16b78d6da2072844617b92

Introduced

491c67be12ca8a9fe37ae38307ba7e298c976ec3

Fixed

1e0bab9050df62437db599a0811018288fc574c8

Introduced

c33464a4554cff8a082bc353d9226d8104b80d2b

Fixed

fd98e9df6fa7f939665764a92c9c5b882f81e0ad

Introduced

6fe64752be3260f2a47f38e68c2cb77400e5a0c9

Fixed

eed2a4d4ba8624199bccbcba795d63cc9a308658

Introduced

9ff4499281663b0c772787fd4a60538288f842e9

Fixed

9da0a44b3e70117089257777cc38a3305a6c6c77

Database specific

{
    "versions": [
        {
            "introduced": "3.7"
        },
        {
            "fixed": "3.7.34"
        },
        {
            "introduced": "3.8"
        },
        {
            "fixed": "3.8.34"
        },
        {
            "introduced": "3.9"
        },
        {
            "fixed": "3.9.32"
        },
        {
            "introduced": "4.0"
        },
        {
            "fixed": "4.0.31"
        },
        {
            "introduced": "4.1"
        },
        {
            "fixed": "4.1.31"
        },
        {
            "introduced": "4.2"
        },
        {
            "fixed": "4.2.28"
        },
        {
            "introduced": "4.3"
        },
        {
            "fixed": "4.3.24"
        },
        {
            "introduced": "4.4"
        },
        {
            "fixed": "4.4.23"
        },
        {
            "introduced": "4.5"
        },
        {
            "fixed": "4.5.22"
        },
        {
            "introduced": "4.6"
        },
        {
            "fixed": "4.6.19"
        },
        {
            "introduced": "4.7"
        },
        {
            "fixed": "4.7.18"
        },
        {
            "introduced": "4.8"
        },
        {
            "fixed": "4.8.14"
        },
        {
            "introduced": "4.9"
        },
        {
            "fixed": "4.9.15"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.0.10"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.6"
        },
        {
            "introduced": "5.2"
        },
        {
            "fixed": "5.2.7"
        },
        {
            "introduced": "5.4"
        },
        {
            "fixed": "5.4.2"
        }
    ]
}

Type

GIT

Repo

https://github.com/wordpress/wordpress-develop

Events

Introduced

d05f0a86b23e37b9d97acd9317ff3fd661d64dea

Fixed

c051f4d7bb12c001d6210a33b2e31c6cf770ee8e

Fixed

0977c0d6b241479ecedfe19e96be69f727c3f81f

Database specific

{
    "versions": [
        {
            "introduced": "5.3.0"
        },
        {
            "fixed": "5.3.4"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4047.json"