GitHub Advisoryadvisory · Packagist

GHSA-3j78-7m59-r7gv Private data exposure via REST API in BuddyPress

HIGH Published 2020-02-24 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-5244
Ecosystem
Packagist
Packages
buddypress/buddypress
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2020-02-24

Affected packages

• Packagist buddypress/buddypress: < 5.1.2 → fixed in 5.1.2

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

Related

Alias · CVE (1)

  • CVE-2020-5244 In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References