CVE-2021-39201

描述

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)

如何修補 CVE-2021-39201

要修補 CVE-2021-39201,請將受影響套件升級到下列已修補版本。

• —升級至 5.8.0 或更新版本
• —升級至 5.8.0 或更新版本

CVE-2021-39201 正在被利用嗎?

低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 5.0.0, < 5.8.0
• >= 5.0.0, < 5.8.0

CVSS 分數

參考連結(4)

• WEBgithub.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94v
• WEBhackerone.com/reports/1142140
• WEBnvd.nist.gov/vuln/detail/CVE-2021-39201
• WEBwww.debian.org/security/2021/dsa-4985