hitoshura25/cvefixes huggingface dataset:
CVE-2017-5612 (PHP, published 2017-01-30T04:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-posts-list-table.php
wp-includes/version.php
Commit message: Posts, Post Types: When using Excerpt mode on the Posts list table, ensure the excerpt output matches what was manually entered into the Excerpt field.

Built from https://develop.svn.wordpress.org/trunk@39956


git-svn-id: http://core.svn.wordpress.org/trunk@39893 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			the_excerpt();
$wp_version = '4.8-alpha-39954';

Fixed code:
			echo esc_html( get_the_excerpt() );
$wp_version = '4.8-alpha-39956';
CVE-2017-6814 (PHP, published 2017-03-12T01:59Z)
Description: value: In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/media.php
wp-includes/version.php
Commit message: Validate video and audio metadata.

Built from https://develop.svn.wordpress.org/trunk@40148


git-svn-id: http://core.svn.wordpress.org/trunk@40087 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-alpha-40147';

Fixed code:
	$metadata = wp_kses_post_deep( $metadata );

	$metadata = wp_kses_post_deep( $metadata );

$wp_version = '4.8-alpha-40148';
CVE-2017-6815 (PHP, published 2017-03-12T01:59Z)
Description: value: In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/pluggable.php
wp-includes/version.php
Commit message: Strip control characters before validating redirect.


Built from https://develop.svn.wordpress.org/trunk@40183


git-svn-id: http://core.svn.wordpress.org/trunk@40122 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	$location = trim( $location );
$wp_version = '4.8-alpha-40181';

Fixed code:
	$location = trim( $location, " \t\n\r\0\x08\x0B" );
$wp_version = '4.8-alpha-40183';
CVE-2017-6816 (PHP, published 2017-03-12T01:59Z)
Description: value: In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/plugins.php
wp-includes/version.php
Commit message: Plugins: Add file check to plugin deletions.


Built from https://develop.svn.wordpress.org/trunk@40169


git-svn-id: http://core.svn.wordpress.org/trunk@40108 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-alpha-40160';

Fixed code:
			// Bail on all if any paths are invalid.
			// validate_file() returns truthy for invalid files
			$invalid_plugin_files = array_filter( $plugins, 'validate_file' );
			if ( $invalid_plugin_files ) {
				wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
				exit;
			}

$wp_version = '4.8-alpha-40169';
CVE-2017-6817 (PHP, published 2017-03-12T01:59Z)
Description: value: In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/embed.php
wp-includes/version.php
Commit message: Embeds: URL encode YouTube video IDs for broader compatibility.
Built from https://develop.svn.wordpress.org/trunk@40160


git-svn-id: http://core.svn.wordpress.org/trunk@40099 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
	$embed = $wp_embed->autoembed( "https://youtube.com/watch?v={$matches[2]}" );
$wp_version = '4.8-alpha-40148';

Fixed code:
	$embed = $wp_embed->autoembed( sprintf( "https://youtube.com/watch?v=%s", urlencode( $matches[2] ) ) );
$wp_version = '4.8-alpha-40160';
CVE-2017-6819 (PHP, published 2017-03-12T01:59Z)
Description: value: In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-admin/includes/class-wp-press-this.php
wp-includes/version.php
Commit message: Press This: Verify intent before fetching in-page resources using Press This.

Props vortfu

Built from https://develop.svn.wordpress.org/trunk@40195


git-svn-id: http://core.svn.wordpress.org/trunk@40134 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				$data = $this->source_data_fetch_fallback( $data['u'], $data );
			'hasData' => ! empty( $data ),
			<input type="url" name="u" id="url-scan" class="scan-url" value="" placeholder="<?php esc_attr_e( 'Enter a URL to scan' ) ?>" />
$wp_version = '4.8-alpha-40183';

Fixed code:
				if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'scan-site' ) ) {
					$data = $this->source_data_fetch_fallback( $data['u'], $data );
				} else {
					$data['errors'] = 'missing nonce';
				}
			'hasData' => ! empty( $data ) && ! isset( $data['errors'] ),
			<input type="url" name="u" id="url-scan" class="scan-url" value="<?php echo esc_attr( $site_data['u'] ) ?>" placeholder="<?php esc_attr_e( 'Enter a URL to scan' ) ?>" />
			<?php wp_nonce_field( 'scan-site' ); ?>
$wp_version = '4.8-alpha-40195';
CVE-2017-9062 (PHP, published 2017-05-18T14:29Z)
Description: value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-xmlrpc-server.php
wp-includes/version.php
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-beta1-40689';

Fixed code:

				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2017-9062 (PHP, published 2017-05-18T14:29Z)
Description: value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-xmlrpc-server.php
wp-includes/version.php
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-beta1-40689';

Fixed code:

				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2017-9062 (PHP, published 2017-05-18T14:29Z)
Description: value: In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-xmlrpc-server.php
wp-includes/version.php
Commit message: Adjust post meta checks

Built from https://develop.svn.wordpress.org/trunk@40692


git-svn-id: http://core.svn.wordpress.org/trunk@40555 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-beta1-40689';

Fixed code:

				if ( ! $pmeta || $pmeta->post_id != $post_id ) {
					continue;
				}

$wp_version = '4.8-beta1-40692';
CVE-2017-9065 (PHP, published 2017-05-18T14:29Z)
Description: value: In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-wp-xmlrpc-server.php
wp-includes/version.php
Commit message: Whitelist post arguments in XML-RPC

Built from https://develop.svn.wordpress.org/trunk@40677


git-svn-id: http://core.svn.wordpress.org/trunk@40540 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
		$defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
			'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
		$post_data = wp_parse_args( $content_struct, $defaults );
		} else {
			// Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
			unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
$wp_version = '4.8-beta1-40676';

Fixed code:
		$defaults = array(
			'post_status'    => 'draft',
			'post_type'      => 'post',
			'post_author'    => null,
			'post_password'  => null,
			'post_excerpt'   => null,
			'post_content'   => null,
			'post_title'     => null,
			'post_date'      => null,
			'post_date_gmt'  => null,
			'post_format'    => null,
			'post_name'      => null,
			'post_thumbnail' => null,
			'post_parent'    => null,
			'ping_status'    => null,
			'comment_status' => null,
			'custom_fields'  => null,
			'terms_names'    => null,
			'terms'          => null,
			'sticky'         => null,
			'enclosure'      => null,
			'ID'             => null,
		);
		$post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
$wp_version = '4.8-beta1-40677';
CVE-2017-9066 (PHP, published 2017-05-18T14:29Z)
Description: value: In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/class-http.php
wp-includes/version.php
Commit message: Improve redirect handling

Built from https://develop.svn.wordpress.org/trunk@40689


git-svn-id: http://core.svn.wordpress.org/trunk@40552 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '4.8-beta1-40677';

Fixed code:
		// Validate redirected URLs.
		if ( function_exists( 'wp_kses_bad_protocol' ) && $r['reject_unsafe_urls'] ) {
			$options['hooks']->register( 'requests.before_redirect', array( get_class(), 'validate_redirects' ) );
		}

	/**
	 * Validate redirected URLs.
	 *
	 * @since 4.7.5
	 *
	 * @throws Requests_Exception On unsuccessful URL validation
	 * @param string $location URL to redirect to.
	 */
	public static function validate_redirects( $location ) {
		if ( ! wp_http_validate_url( $location ) ) {
			throw new Requests_Exception( __('A valid URL was not provided.'), 'wp_http.redirect_failed_validation' );
		}
	}

$wp_version = '4.8-beta1-40689';
CVE-2018-10100 (PHP, published 2018-04-16T09:58Z)
Description: value: Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/version.php
wp-login.php
Commit message: Login: Use `wp_safe_redirect()` when redirecting the login page if forced to use HTTPS.

Built from https://develop.svn.wordpress.org/trunk@42892


git-svn-id: http://core.svn.wordpress.org/trunk@42722 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.0-alpha-42891';
		wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
		wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );

Fixed code:
$wp_version = '5.0-alpha-42892';
		wp_safe_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
		wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
CVE-2018-10101 (PHP, published 2018-04-16T09:58Z)
Description: value: Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/http.php
wp-includes/version.php
Commit message: HTTP: Don't treat `localhost` as same host by default.

Built from https://develop.svn.wordpress.org/trunk@42894


git-svn-id: http://core.svn.wordpress.org/trunk@42724 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
		$same_host = ( strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] ) || 'localhost' === strtolower( $parsed_url['host'] ) );
$wp_version = '5.0-alpha-42893';

Fixed code:
		$same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
$wp_version = '5.0-alpha-42894';
CVE-2018-10102 (PHP, published 2018-04-16T09:58Z)
Description: value: Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/general-template.php
wp-includes/version.php
Commit message: Template: Make sure the version string is correctly escaped for use in attributes.

Built from https://develop.svn.wordpress.org/trunk@42893


git-svn-id: http://core.svn.wordpress.org/trunk@42723 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
			$gen = '<meta name="generator" content="WordPress ' . get_bloginfo( 'version' ) . '">';
			$gen = '<meta name="generator" content="WordPress ' . get_bloginfo( 'version' ) . '" />';
			$gen = '<generator uri="https://wordpress.org/" version="' . get_bloginfo_rss( 'version' ) . '">WordPress</generator>';
			$gen = '<generator>https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) . '</generator>';
			$gen = '<admin:generatorAgent rdf:resource="https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) . '" />';
			$gen = '<!-- generator="WordPress/' . get_bloginfo( 'version' ) . '" -->';
			$gen = '<!-- generator="WordPress/' . get_bloginfo_rss( 'version' ) . '" created="' . date( 'Y-m-d H:i' ) . '" -->';
$wp_version = '5.0-alpha-42892';

Fixed code:
			$gen = '<meta name="generator" content="WordPress ' . esc_attr( get_bloginfo( 'version' ) ) . '">';
			$gen = '<meta name="generator" content="WordPress ' . esc_attr( get_bloginfo( 'version' ) ) . '" />';
			$gen = '<generator uri="https://wordpress.org/" version="' . esc_attr( get_bloginfo_rss( 'version' ) ) . '">WordPress</generator>';
			$gen = '<generator>' . esc_url_raw( 'https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) ) . '</generator>';
			$gen = '<admin:generatorAgent rdf:resource="' . esc_url_raw( 'https://wordpress.org/?v=' . get_bloginfo_rss( 'version' ) ) . '" />';
			$gen = '<!-- generator="WordPress/' . esc_attr( get_bloginfo( 'version' ) ) . '" -->';
			$gen = '<!-- generator="WordPress/' . esc_attr( get_bloginfo_rss( 'version' ) ) . '" created="' . date( 'Y-m-d H:i' ) . '" -->';
$wp_version = '5.0-alpha-42893';
CVE-2019-16220 (PHP, published 2019-09-11T14:15Z)
Description: value: In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/pluggable.php
wp-includes/version.php
Commit message: Improve URL validation in `wp_validate_redirect()`.

Props vortfu, whyisjake, peterwilsoncc.
Built from https://develop.svn.wordpress.org/trunk@45971


git-svn-id: http://core.svn.wordpress.org/trunk@45782 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.3-alpha-45964';

Fixed code:
		if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
			$path = '';
			if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
				$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
			}
			$location = '/' . ltrim( $path . '/', '/' ) . $location;
		}

$wp_version = '5.3-alpha-45971';
CVE-2019-16222 (PHP, published 2019-09-11T14:15Z)
Description: value: WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/kses.php
wp-includes/version.php
Commit message: Fix for URL sanitization that can lead to cross-site scripting (XSS) attacks.

Props irsdl, sstoqnov, whyisjake.
Built from https://develop.svn.wordpress.org/trunk@45997


git-svn-id: http://core.svn.wordpress.org/trunk@45808 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.3-alpha-45990';

Fixed code:
	$string  = preg_replace( '/(&#0*58(?![;0-9])|&#x0*3a(?![;a-f0-9]))/i', '$1;', $string );
$wp_version = '5.3-alpha-45997';
CVE-2019-17669 (PHP, published 2019-10-17T13:15Z)
Description: value: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/http.php
wp-includes/version.php
Commit message: HTTP API: Protect against hex interpretation.

Return earlier from wp_http_validate_url().

Props: iandunn, xknown, voldemortensen, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46475


git-svn-id: http://core.svn.wordpress.org/trunk@46273 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
				$ip = false;
$wp_version = '5.3-beta3-46474';

Fixed code:
				return false;
$wp_version = '5.3-beta3-46475';
CVE-2019-17670 (PHP, published 2019-10-17T13:15Z)
Description: value: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/WordPress/WordPress
Files changed:
wp-includes/pluggable.php
wp-includes/version.php
Commit message: Formatting: In `wp_validate_redirect()`, normalize the path when validating the location for relative URLs, to account for Windows paths.

Props peterwilsoncc, rconde, jmmathc, mat-lipe, Sixes, justinahinon, cmagrin, daxelrod, SergeyBiryukov.
Fixes #47980.
Built from https://develop.svn.wordpress.org/trunk@46472


git-svn-id: http://core.svn.wordpress.org/trunk@46270 1a063a9b-81f0-0310-95a4-ce76da25c4cd


Vulnerable code:
$wp_version = '5.3-beta3-46471';

Fixed code:
				$path = wp_normalize_path( $path );
$wp_version = '5.3-beta3-46472';