PT-2019-13645 · WordPress · Wp Slacksync

Fs0C131Y · Publicado 2019-11-12 · Atualizado 2019-11-14 · CVE-2019-14366

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP SlackSync plugin versions prior to 1.8.6

Description The WP SlackSync plugin for WordPress has an issue where it leaks a Slack Access Token in its source code. This leak allows an attacker to obtain significant information about the victim's Slack environment, including details about channels and members.

Recommendations For WP SlackSync plugin versions prior to 1.8.6, update to version 1.8.6 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-14366

Produtos afetados

Wp Slacksync

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-14366 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14366 · Nota de Segurança
• https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef · Nota