Description

In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.

Remediation

References

CVE-2018-20151

Related Vulnerabilities

Drupal Core 5.x Multiple Security Bypass Vulnerabilities (5.0 - 5.22)

Oracle JRE Cryptographic Issues Vulnerability (CVE-2012-5373)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21610)

Contao Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4335)

Drupal Core 7.x Security Bypass (7.0 - 7.55)

Severity

High

Classification

CVE-2018-20151 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities