PT-2023-11869 · Unknown · Newsletter Manager

Jerome Bruandet · CVE-2020-36727 · Publicado 2023-06-07 · Atualizado 2023-06-13

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newsletter Manager versions up to, and including, 1.5.1

Description The issue is related to insecure deserialization. This is caused by unsanitized input from the customFieldsDetails parameter being passed through a deserialization function, potentially allowing unauthenticated attackers to inject a serialized PHP object.

Recommendations For versions up to, and including, 1.5.1, update to a version that fixes the insecure deserialization issue. As a temporary workaround, consider restricting access to the customFieldsDetails parameter to minimize the risk of exploitation.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2020-36727

Produtos afetados

Newsletter Manager

Referências · 5

• 🔥 https://blog.nintechnet.com/insecure-deserialization-vulnerability-in-wordpress-newsletter-manager-plugin-unpatched · Exploit
• https://wordfence.com/threat-intel/vulnerabilities/id/dcfd8c4d-d48b-468d-a7d5-1ec05b068f79?source=cve · Nota
• https://osv.dev/vulnerability/CVE-2020-36727 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-36727 · Nota de Segurança
• https://wpscan.com/vulnerability/b82124b1-e5e1-4f1e-9513-90474fd3f066 · Nota