PT-2023-11950 · Google · Site Kit By Google

Publicado 2023-07-07 · Atualizado 2023-07-14 · CVE-2020-8934

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Site Kit by Google plugin for WordPress versions up to, and including, 1.8.0

Description The issue is related to Sensitive Information Disclosure due to the lack of capability checks on the admin enqueue scripts action, which displays the connection key. This allows authenticated attackers with any level of access to obtain owner access to a site in the Google Search Console.

Recommendations For versions up to, and including, 1.8.0, upgrade to V1.8.1 or above. As a temporary workaround, consider restricting access to the admin enqueue scripts action until a patch is available.

Correção

Unchecked Return Value

Enumeração de Fraquezas

CWE-252

Identificadores relacionados

CVE-2020-8934

Produtos afetados

Site Kit By Google

Referências · 6

• https://t.me/cibsecurity/66187 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2020-8934 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8934 · Nota
• https://t.me/cvenotify/53846 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-8934 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-site-kit/site-kit-by-google-171-sensitive-information-disclosure · Nota