{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-05-08T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-10T17:34:37", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-9880", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://wpvulndb.com/vulnerabilities/9282", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"name": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"name": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "refsource": "MISC", "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"name": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "refsource": "MISC", "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"name": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "refsource": "CONFIRM", "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.205Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T15:18:36.253661Z", "id": "CVE-2019-9880", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T15:18:44.814Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9880", "datePublished": "2019-06-10T17:32:39", "dateReserved": "2019-03-19T00:00:00", "dateUpdated": "2024-11-15T15:18:44.814Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.205Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-9880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-15T15:18:36.253661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T15:18:41.802Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-05-08T00:00:00", "references": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "tags": ["x_refsource_MISC"]}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2019-06-10T17:34:37"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "name": "https://wpvulndb.com/vulnerabilities/9282", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "name": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "refsource": "MISC"}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "name": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "refsource": "MISC"}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "name": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "refsource": "MISC"}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "name": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-9880", "STATE": "PUBLIC", "ASSIGNER": "[email protected]"}}}}, "cveMetadata": {"cveId": "CVE-2019-9880", "state": "PUBLISHED", "dateUpdated": "2024-11-15T15:18:44.814Z", "dateReserved": "2019-03-19T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2019-06-10T17:32:39", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*", "matchCriteriaId": "282B8AA9-C1E9-4FA0-A4EA-B786BEB7C112", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en el plugin WPGraphQL 0.2.3 para WordPress. Consultando los usuarios RootQuery, esto es posible por un atacante sin identificar, para recuperar todos los detalles de los usuarios WordPress, como direcciones de email, administrador, y nombre de usuario"}], "id": "CVE-2019-9880", "lastModified": "2024-11-21T04:52:29.867", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-06-10T18:29:01.143", "references": [{"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"source": "[email protected]", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "[email protected]", "type": "Primary"}]}

{}