Private data exposure via REST API in BuddyPress

ÉLEVÉE 7.5CVE-2020-5244 · GHSA-3j78-7m59-r7gv · Published 24/02/2020 · updated 17/06/2026

En bref

CVE-2020-5244 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant buddypress/buddypress, buddypress (buddypress).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.4%, plus élevée que 84.3% des vulnérabilités.
Correctif : mettre à jour vers 5.1.2 ou plus récent.

Package	Affected versions	Patched versions
buddypress/buddypress Packagist	`< 5.1.2`	`5.1.2`
buddypress buddypress	`≥ 5.0.0, < 5.1.2`	`5.1.2`

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.

NVD description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

References

buddypress/BuddyPress security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-5244 · ADVISORY
buddypress/BuddyPress commit 3929468 · WEB
buddypress.org/2020/01/buddypress-5-1-2 · WEB
buddypress.org/2020/01/buddypress-5-1-2 · Release Notes

Autres vulnérabilités de buddypress/buddypress

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

buddypress/buddypress

Packagist

< 5.1.2

5.1.2

buddypress

≥ 5.0.0, < 5.1.2

5.1.2

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.

NVD description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

Autres vulnérabilités de buddypress/buddypress

Tout voir →