NVD Vulnerability Detail

CVE-2019-16220

Summary	In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
Publication Date	Sept. 11, 2019, 11:15 p.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:30 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:wordpress:wordpress::::::::					5.2.3

Related information, measures and tools

No	URL	タグ
1	https://core.trac.wordpress.org/changeset/45971	Patch Vendor Advisory
2	https://core.trac.wordpress.org/changeset/45971	Patch Vendor Advisory
3	https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522f5c09614a28	Patch Third Party Advisory
4	https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522f5c09614a28	Patch Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html	Mailing List Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html	Mailing List Third Party Advisory
7	https://medium.com/@theodorejackson.us/rediscovering-an-old-vulnerability-cve-2019-16220-d25cc441752f
8	https://seclists.org/bugtraq/2020/Jan/8	Mailing List Third Party Advisory
9	https://seclists.org/bugtraq/2020/Jan/8	Mailing List Third Party Advisory
10	https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/	Release Notes Vendor Advisory
11	https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/	Release Notes Vendor Advisory
12	https://wpvulndb.com/vulnerabilities/9863	Third Party Advisory
13	https://wpvulndb.com/vulnerabilities/9863	Third Party Advisory
14	https://www.debian.org/security/2020/dsa-4599	Third Party Advisory
15	https://www.debian.org/security/2020/dsa-4599	Third Party Advisory
16	https://www.debian.org/security/2020/dsa-4677	Third Party Advisory
17	https://www.debian.org/security/2020/dsa-4677	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-601	オープンリダイレクト	https://cwe.mitre.org/data/definitions/601.html

JVN Vulnerability Information

WordPress におけるオープンリダイレクトの脆弱性

Title	WordPress におけるオープンリダイレクトの脆弱性
Summary	WordPress の wp-includes/pluggable.php 内の wp_validate_redirect には、URL の検証およびサニタイズを行う場合、オープンリダイレクトの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 5, 2019, midnight
Registration Date	Sept. 12, 2019, 5:43 p.m.
Last Update	Sept. 12, 2019, 5:43 p.m.

Affected System

WordPress.org

WordPress 5.2.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-16220	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16220
National Vulnerability Database (NVD)
2	CVE-2019-16220	https://nvd.nist.gov/vuln/detail/CVE-2019-16220

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-601	https://cwe.mitre.org/data/definitions/601.html

ベンダー情報

No	Name	URL
GitHub
1	Improve URL validation in `wp_validate_redirect()`.	https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522f5c09614a28
WordPress Blog
2	WordPress 5.2.3 Security and Maintenance Release	https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
WordPress Plugin Changeset
3	Changeset 45971	https://core.trac.wordpress.org/changeset/45971

Change Log

No	Changed Details	Date of change
1	[2019年09月12日] 掲載	Sept. 12, 2019, 5:43 p.m.