CVE-2019-9880

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-05-08T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-10T17:34:37.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9880", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://wpvulndb.com/vulnerabilities/9282", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"name": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"name": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "refsource": "MISC", "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"name": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "refsource": "MISC", "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"name": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "refsource": "CONFIRM", "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.205Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T15:18:36.253661Z", "id": "CVE-2019-9880", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T15:18:44.814Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9880", "datePublished": "2019-06-10T17:32:39.000Z", "dateReserved": "2019-03-19T00:00:00.000Z", "dateUpdated": "2024-11-15T15:18:44.814Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:01:55.205Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-9880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-15T15:18:36.253661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T15:18:41.802Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-05-08T00:00:00.000Z", "references": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "tags": ["x_refsource_MISC"]}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2019-06-10T17:34:37.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://wpvulndb.com/vulnerabilities/9282", "name": "https://wpvulndb.com/vulnerabilities/9282", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "name": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html", "refsource": "MISC"}, {"url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "name": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/", "refsource": "MISC"}, {"url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "name": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py", "refsource": "MISC"}, {"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "name": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-9880", "STATE": "PUBLIC", "ASSIGNER": "cve@mitre.org"}}}}, "cveMetadata": {"cveId": "CVE-2019-9880", "state": "PUBLISHED", "dateUpdated": "2024-11-15T15:18:44.814Z", "dateReserved": "2019-03-19T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2019-06-10T17:32:39.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*", "matchCriteriaId": "282B8AA9-C1E9-4FA0-A4EA-B786BEB7C112", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en el plugin WPGraphQL 0.2.3 para WordPress. Consultando los usuarios RootQuery, esto es posible por un atacante sin identificar, para recuperar todos los detalles de los usuarios WordPress, como direcciones de email, administrador, y nombre de usuario"}], "id": "CVE-2019-9880", "lastModified": "2026-06-17T02:44:46.803", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-9880", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-15T15:18:36.253661Z", "version": "2.0.3"}}]}, "published": "2019-06-10T18:29:01.143", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wpvulndb.com/vulnerabilities/9282"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}