Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2020-5244

Private data exposure via REST API in BuddyPress

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

buddypress BuddyPress

  • < 5.1.2affected

References