What is CVE-2020-8934?

CVE-2020-8934 is a medium-severity vulnerability in Google Site Kit, classified under CWE-252. CVSS score: 4.3/10. Published 2023-07-07.

How severe is CVE-2020-8934?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2020-8934 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Google Site Kit

CVE-2020-8934

The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.

EPSS: 0.002 (16.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Google Site_kit
Google Site Kit By — versions 0

Weakness classification (CWE)

CWE-252

Public proof-of-concept exploits

References

cve-coordination@google.com (Third Party Advisory)

Frequently asked questions

What is CVE-2020-8934?: CVE-2020-8934 is a medium-severity vulnerability in Google Site Kit, classified under CWE-252. CVSS score: 4.3/10. Published 2023-07-07.
How severe is CVE-2020-8934?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2020-8934 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.