PT-2023-16092 · WordPress · Fluentsmtp

Vaibhav Rajput · Publicado 2023-03-13 · Atualizado 2023-03-16 · CVE-2023-0219

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FluentSMTP WordPress plugin versions prior to 2.2.3

Description The issue arises from the plugin's failure to sanitize or escape email content, making it susceptible to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires the presence of other plugins that enable users to send emails with unfiltered HTML.

Recommendations For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the viewing of email logs until a patch is applied. Restrict access to the email logs to minimize the risk of exploitation. Avoid using plugins that enable users to send emails with unfiltered HTML in the affected versions until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-0219

Produtos afetados

Fluentsmtp

Referências · 5

• 🔥 https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c · Exploit
• https://osv.dev/vulnerability/CVE-2023-0219 · Aviso do Fabricante
• https://t.me/cvenotify/46341 · Publicação no Telegram
• https://t.me/cibsecurity/59921 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0219 · Nota de Segurança