CVE-2020-13764 - common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call

Back Back to CVE browser

HIGH

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call

Published Jun 2, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.83%

Description

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (5)

https://docs.gravityforms.com/gravityforms-change-log
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4532
Advisory
https://github.com/advisories/GHSA-m983-q76g-cwpq
Advisory
https://github.com/wp-premium/gravityforms/compare/2.4.8...2.4.9
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-13764

Link	Providers	Tags
https://docs.gravityforms.com/gravityforms-change-log		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4532		Advisory
https://github.com/advisories/GHSA-m983-q76g-cwpq		Advisory
https://github.com/wp-premium/gravityforms/compare/2.4.8...2.4.9		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-13764