CVE-2023-5561 Vulnerability Details

  /     /     /  

CVE-2023-5561 Metadata Quick Info

CVE Published: 16/10/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: WPScan | Vendor: WordPress | Product: WordPress
Status : PUBLISHED

---

CVE-2023-5561 Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Source: WordPress

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).