Private data exposure via REST API in BuddyPress · CVE-2020-5244 · GitHub Advisory Database · GitHub

Private data exposure via REST API in BuddyPress

High severity GitHub Reviewed Published Feb 24, 2020 in buddypress/buddypress • Updated Jan 9, 2023

Package

buddypress/buddypress (Composer)

Affected versions

< 5.1.2

Patched versions

5.1.2

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.

References

ehti published to buddypress/buddypress

Feb 24, 2020

Reviewed Feb 24, 2020

Published to the GitHub Advisory Database Feb 24, 2020

Last updated Jan 9, 2023

Severity

High

8.0

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N