CVE-2020-35539
CVSS V2 None
CVSS V3 Critical 9.8
Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Overview
- CVE ID
- CVE-2020-35539
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Rejected
- Published Version
- 2022-10-17T16:15:15
- Last Modified Date
- 2022-12-07T18:15:09
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:wordpress:wordpress:5.1:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://seclists.org/fulldisclosure/2021/Mar/24 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-35539 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35539 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-10-17 17:00:18 | Added to TrackCVE | |||
| 2022-12-07 08:13:40 | 2022-10-17T16:15Z | 2022-10-17T16:15:15 | CVE Published Date | updated |
| 2022-12-07 08:13:40 | 2022-10-19T14:54:36 | CVE Modified Date | updated | |
| 2022-12-07 08:13:40 | Analyzed | Vulnerability Status | updated | |
| 2022-12-07 19:15:10 | 2022-12-07T18:15:09 | CVE Modified Date | updated | |
| 2022-12-07 19:15:10 | Analyzed | Rejected | Vulnerability Status | updated |
| 2022-12-07 19:15:11 | A flaw was found in Wordpress 5.1. "X-Forwarded-For" is a HTTP header used to carry the client's original IP address. However, because these headers may very well be added by the client to the requests, if the systems/devices use IP addresses which decelerate at X-Forwarded-For header instead of original IP, various issues may be faced. If the data originating from these fields is trusted by the application developers and processed, any authorization checks originating IP address logging could be manipulated. | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | Description | updated |