Security Advisory

CVE-2020-35934

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-01-01 01:25:05

Last updated 2024-08-04 17:16:13

Assigner mitre

CVSS score 4.3

State PUBLISHED

Description

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).

← Browse all CVEs View on cve.org ↗