CVE-2020-5244

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-200

Affected software

Vendor	Product	Versions
buddypress	BuddyPress	< 5.1.2

References

https://buddypress.org/2020/01/buddypress-5-1-2/Release Notes, Vendor Advisory
https://github.com/buddypress/BuddyPress/commit/39294680369a0c992290577a9d740f4a2f2c2ca3Patch, Third Party Advisory
https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gvThird Party Advisory
https://buddypress.org/2020/01/buddypress-5-1-2/Release Notes, Vendor Advisory
https://github.com/buddypress/BuddyPress/commit/39294680369a0c992290577a9d740f4a2f2c2ca3Patch, Third Party Advisory
https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gvThird Party Advisory

Timeline

Published: Feb 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52458.8Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard CVE-2020-52466.5Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search fi CVE-2020-52477.5In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can CVE-2020-52485.3GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. Th CVE-2020-52496.5In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use CVE-2020-52506.3In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal CVE-2020-52515.3In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use CVE-2020-52524.1The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code CVE-2020-52539.8NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be e CVE-2020-52548.1In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.CVE-2020-52554.3In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fal CVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow th