Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

automattic/jetpack

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PackagistPublished

    JetPack Exposure of Resource to Wrong Sphere

    CVE-2021-24374 · GHSA-5hr6-r8h6-wh22

    Affected
    • Packagist automattic/jetpack < 9.8
    Fixed in
    9.8· Vendor fix available
    Issue
    The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhgvcs that allowed the comments of non-published page/posts to be leaked.

    Recommended action: Upgrade to 9.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →