PT-2023-11856 · WordPress · Brizy

Jerome Bruandet · Publicado 2023-10-20 · Atualizado 2025-01-16 · CVE-2020-36714

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brizy plugin for WordPress versions up to, and including, 1.0.125

Description The issue is related to an incorrect capability check on the is administrator() function, which allows authenticated attackers to bypass authorization and access available AJAX functions. This enables them to interact with these functions in an unauthorized manner.

Recommendations For versions up to, and including, 1.0.125, update to a version that fixes the incorrect capability check on the is administrator() function to prevent authorization bypass. As a temporary workaround, consider restricting access to available AJAX functions until a patch is available.

Exploit

Correção

Incorrect Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-863

CWE-285

Identificadores relacionados

CVE-2020-36714

Produtos afetados

Brizy

Referências · 7

• 🔥 https://blog.nintechnet.com/wordpress-brizy-page-builder-plugin-fixed-critical-vulnerabilities · Exploit
• https://wordfence.com/threat-intel/vulnerabilities/id/9495e25d-a5a6-4f25-9363-783626e58a4a?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36714 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-36714 · Aviso do Fabricante
• https://twitter.com/DMFezzaReedCISA/status/1715310411187171389 · Publicação no Twitter
• https://t.me/cibsecurity/72647 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1715271110181163023 · Publicação no Twitter