CVE-2018-20149

Description

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

Weakness classification

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Product, Vendor Advisory
• cve@mitre.org — Patch, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Press/Media Coverage, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory