CVE-2020-5244: Private data exposure via REST API in BuddyPress
In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.
This has been patched in version 5.1.2.
Other sources
Private data exposure via REST API in BuddyPress
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/buddypress/buddypressto a version that resolves this vulnerability.Fixed in 5.1.2 - Upgrade
Upgrade
BuddyPressto a version that resolves this vulnerability.Fixed in 5.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5244?
CVE-2020-5244 is classified as a moderate severity vulnerability.
How do I fix CVE-2020-5244?
To fix CVE-2020-5244, update BuddyPress to version 5.1.2 or later.
What does CVE-2020-5244 affect?
CVE-2020-5244 affects BuddyPress versions prior to 5.1.2.
What type of data is exposed in CVE-2020-5244?
CVE-2020-5244 can expose private user data through a certain REST API endpoint.
Is authentication required to exploit CVE-2020-5244?
No, CVE-2020-5244 can be exploited without any authentication.