GHSA-3j78-7m59-r7gv

Private data exposure via REST API in BuddyPress

Source: GitHub Advisory Database (reviewed) High CVE-2020-5244

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	buddypress/buddypress	< 5.1.2	5.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

References

External links from the advisory. They lead to third-party sites.

https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gv web
https://nvd.nist.gov/vuln/detail/CVE-2020-5244 advisory
https://github.com/buddypress/BuddyPress/commit/39294680369a0c992290577a9d740f4a2f2c2ca3 web
https://buddypress.org/2020/01/buddypress-5-1-2 web